By 1884, Lawrence Alma-Tadema (1836–1912) and his wife Laura (1852–1909) were exhibiting successfully, as well as raising their daughters Anna (1864-1940) and Laurense (1865-1940). Although the younger Laurense went on to become a prolific novelist and poet, Anna was taught to paint by her parents.

Anna was a precocious and brilliant painter in watercolours, and her earliest surviving works, made when she was only seventeen or eighteen, document the interior of the family home near Regent’s Park, London. Sir Lawrence Alma-Tadema’s Library in Townshend House, London (1884) is a meticulously detailed account of that room, even down to the details of its stained glass. That cannot have been this painting’s original title, though, as Anna’s father wasn’t knighted for a further fifteen years.

Anna’s small watercolour of The Drawing Room, Townshend House (1885), painted the following year, shows her improved skills at depicting surface light and texture. This painting was exhibited at the World’s Columbian Exposition in Chicago in 1893, a remarkable achievement for someone who was only eighteen at the time that it was painted.

Lawrence’s A Foregone Conclusion (1885) was commissioned as a wedding gift to the second wife of Sir Henry Tate, founder of the London gallery, Amy Hislop, by Tate himself. It’s one a series on the theme of courtship and marriage: this shows a suitor (left) bringing an engagement ring to his girlfriend ready for his proposal of marriage to her. She hides behind a marble wall with her attendant, their attitude suggesting that his proposal will be successful.

Anna progressed rapidly, and this Self-portrait was one of her early oil paintings, probably dating from around 1887, or slightly later. Its puzzling background is another part of the family home, by then in Saint John’s Wood, to which they moved in 1886. It’s believed that this too was exhibited at the World’s Columbian Exposition in Chicago, in 1893.

Lawrence’s Priestess of Apollo from about 1888 shows one of the priestesses devoted to the god of the sun, who rode the chariot of the sun across the sky each day. He signed this painting in the inscription under the arch, dedicating it to Sir Charles Hallé (1819-1895), the famous conductor who founded the Hallé Orchestra in 1858, and his second wife, the widowed violinist Wilma Neruda; they married in 1888, and this appears to have been another wedding gift.

Spring (1894) is one of Lawrence’s largest and most complex paintings, which took him four years to complete. It shows the spring celebrations in honour of the goddess Flora, the April Florialia.

Hidden in its extravaganza of flowers, marble, pretty girls and young women, are some rather ruder references. The banner at the back of the procession, hung from a balcony, contains verse addressed to Priapus, the god of fertility. This was amplified by attached lines from the contemporary poet Swinburne, which continued by referring to the budding of sexual love in the spring, although those lines remained unquoted here. Finer details on some of the instruments and other objects in the painting show couples frolicking in a state of undress, and there are herms concealed in other parts. The painting was purchased by Robert Mendelssohn-Bartholdy.

A Knock at the Door (1897, Opus 90) is Laura’s most explicit painting in terms of dates. It’s set in 1684, during the period of peace between the Second Treaty of Westminster (1674) and Treaty of Nijmegen (1678), and the crisis in relations with England arising in 1688. We see an attractive young woman, apparently checking that she is looking at her best in a mirror, presumably just before she receives a visitor. On either side there are brief glimpses of open windows.

In 1899, Lawrence was knighted, and in 1900 he was awarded the Grand Prix at the Exposition Universelle in Paris. His second wife Laura died in 1909, and the following year a memorial exhibition of her paintings was held at the Fine Art Society.

Lawrence Alma-Tadema died in 1912, and was buried in Saint Paul’s Cathedral in London, a great mark of honour for any British artist.

Anna continued to exhibit at the Royal Academy until 1928. Following her father’s death, the value of his paintings collapsed, plunging both daughters into poverty. Neither ever married, but Anna continued to make a frugal livelihood from her paintings, which all seem to have vanished.

Reference

Barrow RJ (2001) Lawrence Alma-Tadema, Phaidon Press. ISBN 978 0 7148 4358 2.

The most worrying feature of the current AI ‘revolution’ is how heavily it’s being promoted by everyone from vibe coders to governments. The best and most enduring revolutions are quiet, and bring change because they’re so compelling. If something new has to be heavily evangelised, look deeply inside it to discover why, and who stands to gain most from that snake-oil.

In the case of Mac firmware, change has been so underplayed that you might not have realised what has happened over the last decade. But Macs have gone from impending disaster in Thunderstrike 2 with many running old firmware known to be vulnerable, to Secure Boot and thoroughly reliable updates.

In 2015 Trammell Hudson, Xeno Kovah and Corey Kallenberg demonstrated a firmware worm they named Thunderstrike 2 that could have been abused to insert malware in boot flash storage in Macs. Had that been exploited it would have been disastrous. Apple acted quickly by hiring Kovah and Kallenberg, and a third firmware security researcher Nikolaj Schlej, but shortly after that Rich Smith and Pepijn Bruienne, then of Duo Labs, reported that many Macs were running outdated firmware. When Apple addressed Thunderstrike 2 it could thus have taken a year or more before most Macs would have been protected.

While Kovah, Kallenberg and Schlej were busy securing firmware, and developing eficheck to routinely screen it in every Mac each week, several of us were trying to work out how to maintain a list of current firmware versions for users to check their Macs against. The answer came in eficheck, which obligingly informed us of those it accepted, and we then discovered how to extract firmware update information from macOS updates, for which I’m eternally grateful to Pico for doing the work. From 4 October 2017 those version lists have been published on this blog.

Two years later, in July 2019, firmware version checking was automated in EFIcienC, the precursor to SilentKnight, and became one of the pillars of checking that your Mac was secure.

In my latest revision of that guidance I was at last able to write that firmware “no longer needs to be checked separately” from macOS. My latest list of firmware versions for macOS 26 Tahoe contains just two, compared with over 39 given for High Sierra. The concern of dozens of articles here over those ten years, firmware and its updating can now be trusted, as Macs have moved from EFI to iBridge (T2) and iBoot (Apple silicon), with modern macOS updaters that install firmware reliably. Well, almost every time.

While Apple implies this in its Platform Security Guide, this remains a quiet revolution that didn’t mean anything to marketing, nor was there any mention in a press release. Neither do Apple’s support notes explain how it makes Apple silicon Macs the first to run the firmware matched with their macOS, and to be fully downgradable using IPSW image files.

This journey hasn’t been smooth, and many will still remember models such as the iMac Retina 5K 27-inch Late 2015 (iMac17,1), which in certain configurations simply wouldn’t update its firmware. We discovered that some other Macs updated reliably until their internal storage was replaced. In the end it was the introduction of the T2 chip that made the big difference, bringing the same EFI and iBridge versions across the whole range of Macs.

Compare this with UEFI Secure Boot, an option that Apple wisely decided not to pursue. One recent vulnerability that could have allowed an attacker to deploy malicious bootkits in systems with Secure Boot enabled was reported by ESET in June 2024, but that vulnerable firmware wasn’t revoked by Microsoft until 14 January 2025. Another recent UEFI vulnerability affecting multiple models of Framework computers, BombShell, allows bypass of their Secure Boot, requiring firmware updates that are still being rolled out.

Sometimes we need to look back to see how far we have come.

Painting often runs in the family, as so well illustrated in the Brueghels of Flanders and Brabant. This weekend I look at an artistic family you’re unlikely to have heard of, the Alma-Tademas of London, husband Lawrence, wife Laura, and daughter Anna.

Born as Lourens Alma Tadema in Dronrijp, in the north of the Netherlands, Lawrence (1836–1912) was left to draw and paint following crises in his physical and mental health when he was only 15. By the following year his skills were sufficient for him to enter the Royal Academy of Antwerp, Belgium, where he spent four years. During the later years of that training he worked as a studio assistant to one of the professors at the academy, and became fascinated by Merovingian history.

In 1858-9 he moved to work for Baron Jan August Hendrik Leys, who also acted as his mentor. Leys was an avid painter of mediaeval scenes, who was also a major influence on the early work of the French painter James Tissot.

The Education of the Children of Clovis (also known as The School of Vengeance, or The Training of Clotilde’s Sons) (1861) returns to tales from Merovingian history, showing Saint Clotilde watching her young sons being taught the royal art of axe-throwing. It’s no wonder that later one of them was to murder two of her grandchildren.

In 1862, Alma-Tadema set up his own studio, and the following year he married, honeymooning in Florence, Rome, Naples, and in the excavated ruins of nearby Pompeii.

The year 1869 was a disaster for the Alma-Tadema family. Although Lawrence’s career as a painter had been starting to flourish, his wife Pauline had not been well for a long time, and died suddenly of smallpox. His own health had faltered, but his doctors in Brussels couldn’t agree on a diagnosis. This left him with one option: to go to London to get a second opinion, which he did in December. Once there he was quickly invited to Ford Madox Brown’s house, where he met the two younger Epps girls, then aged nineteen and seventeen.

The oldest of them, Emily (c 1842-1912), was taught by the leading Pre-Raphaelite landscape painter John Brett, and married to become Mrs Emily Williams. The middle daughter, Ellen (1850-1929), was taught by Ford Madox Brown, and married the poet Sir Edmund William Gosse (1849-1928). After their husbands died, Emily and Ellen shared a studio, but neither really achieved fame in their painting.

It was the youngest daughter, born Laura Theresa Epps (1852–1909), with whom Lawrence fell in love at first sight, although he was nearly thirty-four himself. He returned to his family in Brussels, still infatuated with young Laura. Then in July 1870, the Franco-Prussian War broke out, and the whole Alma-Tadema family – Lawrence, his two young daughters, and his sister Atje, who acted as housekeeper – fled to London, where he settled in the September, marrying Laura in July of the following year.

At the age of only nineteen Laura found herself an artist’s wife, step-mother to Laurense and Anna (then seven and four years old), and trying to start her own career as a painter. He quickly became friends with the artists of the Pre-Raphaelite Movement, and his palette brightened. He enjoyed rapid commercial success, and in 1873 Queen Victoria made him an official ‘Denizen’, giving him most of the rights of citizenship.

This is his portrait of The Artist’s Wife when they married.

The Vintage Festival (1871) is one of two similar versions of the same scene, painted using the much brighter and lighter palette that Lawrence developed as he settled in England. It marks the start of his mature style, using classical Greek and Roman themes depicted in intricate detail. These details were researched extensively, sometimes taking as long as two years for a single painting. Following early criticism of his initial attempts to depict the surface properties of marble, he devoted a great deal of effort to painting marble better than any previous artist, so becoming the master of marble.

The meticulous detail in his paintings often gives the impression that these are large canvases and panels, although many are quite small. He was obsessive with what he saw as accuracy, and repeatedly repainted passages until he felt they were perfect.

This painting shows his vision of a Bacchanal being celebrated by musical Bacchantes in a private villa. Its tame nature may surprise those accustomed to thinking of such festivals as rampage, but gives scope for fine details such as the leather straps on the faces of those playing wind instruments. It also has a strong sense of Aestheticism, with its evocation of sound and music, as well as the heady aromas from burning incense.

Despite her new and demanding roles, Laura was quick to achieve recognition in her painting. Her first work to be exhibited at the Salon in Paris was in 1873, and that same year she started exhibiting at the Royal Academy in London. I don’t know if her early painting The Tea Party (date not known, Opus 7) was one of those, but I believe it shows her step-daughter Laurense playing with her dolls.

Lawrence was also a skilled painter of portraits; his most touching, though, must be This is Our Corner (1873), a double portrait of his daughters Anna (1864-1940) in front, and Laurense (1865-1940) behind. They both remained unmarried through adult life: Anna became an accomplished artist, and Laurense a prolific novelist and poet.

Sunny Days (1874) may come as a surprise to those who know Lawrence for his Salon-style works, but during the 1870s he started painting small landscapes, typically of his family when they were on holiday. This shows his daughter Anna in what could be seen as the closest that he came to Impressionism, and was perhaps modelled after one of Monet’s paintings of the time. On this occasion, the landscape is only in Surrey, but he also painted these when in mainland Europe.

Laura’s World of Dreams from 1876 introduces a theme that she was to develop in her mature works: the reflection and transmission of images in mirrors and windows, adding depth to what would otherwise be a shallow view. Here a nurse/nanny (or possibly mother) has fallen asleep, exhausted, on a large illustrated family Bible, which is open at the start of the book of Amos.

Laura was one of only two British women artists to have work accepted for the Exposition Universelle in Paris in 1878.

A Looking out o’Window, Sunshine (?1881, Opus 81) is by far the most outstanding of Laura’s paintings that I have found, with its captivating portrayal of childhood, radiant lightness, and its play of reflections on the glass of the window. It’s also composed to reverse the normal balance in brightness between indoors and out: in reality, of course, outdoor light levels would have been much greater than those indoors, but Laura has managed to ‘cheat’ that by her choice of light colours in the interior wood, clothing, and chair.

Reference

Barrow RJ (2001) Lawrence Alma-Tadema, Phaidon Press. ISBN 978 0 7148 4358 2.

Here are this weekend’s Mac riddles to entertain you through family time, shopping and recreation.

1: Sounds like forty to a Roman working with tables to be the best.

2: Four hundred spun up for audio or data.

3: Run as a guest, it could be 995.

To help you cross-check your solutions, or confuse you further, there’s a common factor between them.

I’ll post my solutions first thing on Monday morning.

Please don’t post your solutions as comments here: it spoils it for others.

It has been 22 years since Apple’s first version of FileVault was introduced in Mac OS X 10.3 Panther. Since then it has changed beyond all recognition, and has been transformed from a questionable option to an essential feature of Apple silicon Macs. This article explains those changes, and how enabling FileVault is now a no-brainer.

The past

FileVault 1 was very different. For a start, it didn’t attempt to encrypt whole volumes, as that still isn’t built into HFS+ and only became possible in Mac OS X 10.7 Lion, when Apple added a logical volume manager, Core Storage. So this first effort stored your Home folder in an encrypted disk image, something that also proved easy to crack.

Apple’s second attempt at FileVault proved more successful, with Core Storage handling the encryption of whole HFS+ volumes. This required encryption and decryption to be performed in software, in the days when most CPUs didn’t have instructions to accelerate that. When you first enabled FileVault, macOS had to encrypt the entire contents of the boot volume, which before Catalina included the whole of the system as well as user data. Fortunately, Apple engineered this initial encryption to run in the background while you were still using your Mac. Even so, it could take several days before it was complete and FileVault became active.

This improved with time. Intel CPUs gained instructions to accelerate encryption and decryption, storage and processors got faster, and Apple’s new file system APFS has encryption designed into it from the start. What transformed FileVault, though, was the introduction of the T2 chip in 2017.

The T2 chip was designed for FileVault, among its other accomplishments. It contains a Secure Enclave to isolate and protect encryption keys, and a hardware AES encryption/decryption engine that sits between the internal SSD controller and memory. Those ensure that the contents of the internal SSD can be encrypted for FileVault without any detectable overhead. From Big Sur onwards, these are used to encrypt the whole contents of the Data volume when it’s in internal storage, but not the System volume or the SSV from which the Mac boots.

FileVault base encryption

In Macs with T2 or Apple silicon chips when FileVault is disabled, everything in the Data volume stored on their internal SSD is still encrypted, but without any user password.

Generating the key used to encrypt the volume, the Volume Encryption Key or VEK, requires two huge numbers, a hardware key unique to that Mac, and the xART key generated by the Secure Enclave as a random number. The former ties the encryption to that Mac, and the latter ensures that an intruder can’t repeat generation of the same VEK even if it does know the hardware key. When you use Erase All Content and Settings (EACAS), the VEK is securely erased, rendering the encrypted data inaccessible, and there’s no means to either recover or recreate it.

This scheme lets the Mac automatically unlock decryption, but doesn’t put that in the control of the user, who therefore needs to enable FileVault to get full protection.

FileVault full encryption

Rather than trying to incorporate a user password or other key into the VEK, like many other encryption systems FileVault does this by encrypting the VEK using a Key Encryption Key or KEK, a process known as wrapping.

When you enter your FileVault password, that’s passed to the Secure Enclave, where it’s combined with the hardware key to generate the KEK, and that’s then used together with hardware and xART keys to decrypt or unwrap the VEK used for decryption/encryption. This means that the primary user’s FileVault password is the same as their regular login password. It doesn’t have to be long and complicated either, as it’s combined with the hardware key to create the KEK.

This has several important benefits. When you first turn FileVault on, no data encryption is needed, as the VEK remains the same, so FileVault’s protection is effective immediately. Because the KEK can be changed without producing a new VEK, the user password can be changed without the contents of the protected volume having to be fully decrypted and encrypted again.

Recovery keys

It’s also possible to generate multiple KEKs to support the use of recovery keys that can be used to unlock the VEK when the user’s password is lost or forgotten. Institutional keys can be created to unlock multiple KEKs and VEKs where an organisation might need access to protected storage in multiple Macs.

When you enable FileVault, you’re given the option of being provided with a recovery key, which you should keep a copy of in a safe place, or using iCloud recovery if you prefer.

In the recent past, some macOS updates have played games with recovery keys, issuing new ones when they weren’t expected. When you first get your recovery key, and any time it changes, you should check to see if it will work correctly. Once your Mac is running fully, open Terminal and type in the command
sudo fdesetup validaterecovery
After entering your admin password, you’ll then be prompted to enter the recovery key to be checked. Type or paste that in carefully, and you’ll be told whether it’s correct or not. Note that Terminal doesn’t display the key when you type or paste it in, and you’ll have to press Return without being able to see or check what you’ve entered. If that new key fails, repeat the command using your previous recovery key instead.

FileVault on other disks

The Secure Enclave and AES engine are only wired up to protect volumes on your Mac’s internal SSD. You can still enable FileVault on bootable external disks, and even in macOS virtual machines. But in those cases, volumes that are protected use Encrypted APFS in software, which does impose a small overhead. In the case of VMs, FileVault is the only effective way to safeguard data in that VM, and is recommended. For external disks you’ll need to weigh up the pros and cons.

Summary

• FileVault in modern T2 and Apple silicon Macs is very different from in the past.
• It now provides excellent cost-free protection to your data when stored on the internal SSD.
• If you opt for a recovery key, check it then and whenever it has changed.
• If your T2 or Apple silicon Mac doesn’t have FileVault enabled, why not?

In Europe, tigers were best known from the Bengal tiger of the Indian subcontinent, although there were also Caspian tigers in Turkey until they became extinct in the 1970s. As the latter had bright rust-red fur with brown stripes, it should be possible to distinguish them, but I haven’t seen any matching that description in European paintings.

In mythology, tigers are most commonly associated with Bacchus/Dionysus, whose chariot they draw, although there’s considerable variation in the species depicted.

Ariadne on Naxos (1913) is one of Lovis Corinth’s most sophisticated mythical paintings, and was inspired by the first version of Richard Strauss’s opera Ariadne auf Naxos, rather than any classical account.

The group in the middle and right is centred on Dionysus, who clutches his characteristic staff in his left hand, and with his right hand holds the reins to the leopard and tiger drawing his chariot. Leading those animals is a small boy, and to the left of the chariot is a young bacchante.

Tigers also feature with other species of large cat including lions in depictions of Christian martyrdom.

I expect that Briton Rivière was well aware of the contemporary paintings of Gérôme showing scenes of gladiatorial combat and martyrdom in classical Rome. Those may have inspired his A Roman Holiday (1881), showing a wounded Christian inscribing a cross in the sand as a tiger lies dead by him, and another snarls behind.

Tigers became popular in zoos and other animal collections around Europe. When he was in Paris, one of Eugène Delacroix’s favourite activities was to visit the zoo at the city’s Jardin des Plantes and sketch the big cats there.

His pastel painting of a Tiger Preparing to Spring from about 1850 demonstrates his mastery of the medium.

Henri Rousseau’s Tiger in a Tropical Storm (Surprised!) from 1891 is a fine portrait of a tiger moving through dense vegetation in torrential rain.

Peter Paul Rubens’ Tiger Hunt from about 1616 packs its canvas with hunters, their horses, and a collection of big cats, including two tigers, a lion and a leopard. A Samson-like figure in the left foreground is wrestling with the lion’s jaws, as one of the tigers buries its teeth into the left shoulder of the Moorish hunter in the centre.

Colonial powers used elephants when hunting big game such as tigers in countries like India, as seen in this painting attributed to the animal specialist Briton Rivière, Tiger Hunt.

Those tigers that were killed had an unusual fate, as their skin became a prop for beautiful women.

John William Godward’s Dolce Far Niente from 1897 adopts a classical Roman setting, with his model lying and doing sweet nothing on a tiger skin.

Time is central to any log, and with the high performance of the Unified log it’s fundamental. It’s also one of its most confusing aspects, particularly when you add time zones, seasonal clock changes, and clock synchronisation.

Clock ticks

I believe each log entry includes the Mach absolute time (MAT) when that entry was made, and those form the log’s internal timebase. However, Apple doesn’t document that, there are alternatives such as Mach continuous time, and times exposed in the public OSLog API are limited to opaque Date structures rather than MAT. In contrast, the log show command can return a numeric field named machTimestamp that does appear to contain the MAT of that log entry.

The first complication with time is that MAT differs between Intel and Apple silicon Macs. While each increment in MAT represents one nanosecond in Intel Macs, in Apple silicon chips MAT ticks occur three times every 125 nanoseconds, or once every 41.67 ns. These are monotonic, in that they always move forward, so every subsequent tick count is greater than (or equal to) the previous ones, unlike wallclock time.

I have looked in detail at how this is reflected in times shown in the log when accessed by different methods, including that now used by LogUI. In practice, this means that the finest resolution of time in LogUI is 1 microsecond, which should suffice for almost every purpose.

Wallclock time

While MAT can be useful for measuring differences in time with great precision, it doesn’t tell you the time in terms of real-world clocks, or wallclock time. Conversion between those relies on data stored in opaque timesync files stored alongside log files. Those are used to provide a wallclock time for each log entry when it’s obtained either through the log show command, or the opaque Date structure in the OSLog API that LogUI relies on. It’s here we encounter all the complexities of the wallclock, such as time zones, seasonal time corrections, and corrections to synchronise with global time references.

Times shown in log entries also need to match those set in the log browser. In practice that leaves two options for times shown in log entries: express them in the local time when they were saved to the log, or in the local time when they’re extracted from the log. By default, the log show command adopts the former, as does Ulbow because it gets its log entries using that command tool, but LogUI converts all times to local time when the log extract is obtained. log show does have an option --timezone local to synchronise entries to current local time, but that’s seldom used.

Wallclock adjustment

The only time measure that remains unaffected by system wallclock time adjustments is MAT. No matter how a wallclock time is expressed, though, there will always be a hiatus and the risk of duplicate times being given, for example with consecutive entries of
08:26:16.140474+0100
08:26:10.043353+0100 === system wallclock time adjusted
08:26:10.044335+0100

If you’re using the log to measure time, and those measurements span a wallclock adjustment, you will need to make a manual adjustment to allow for that.

Time zone and season

When times of log entries are expressed using the local time applicable when those entries were written, changes in time zone and seasonal adjustments become confusing. For example, these entries were written when the wallclock was advanced by one hour in accordance with the start of British Summer Time:
2020-03-29 01:09:22.489149+0000 361080253974026
2020-03-29 01:09:22.489160+0000 361080253985232
2020-03-29 02:09:22.522734+0100 361080253990360 === system wallclock time adjusted
2020-03-29 02:09:22.522749+0100 361080254005593
2020-03-29 02:09:22.522913+0100 361080254170158
In each case, the wallclock date and time are given first, followed by the MAT (from an Intel Mac), demonstrating that the hiatus of one hour doesn’t affect the latter.

According to convention, Summer time adjustments across Europe are made at 01:00:00 +0000 (UTC). So in the Spring, clocks are put forward from 01:00:00 regular time to 02:00:00 Summer time. In North America, changes are made at 02:00:00 local, and usually on different days. Because of the way that macOS manages time, changes to the system clock will inevitably occur shortly after the officially set time, in that case nearly ten minutes later.

To avoid this confusion, LogUI expresses wallclock and control times using local time when those entries are extracted from the log. In that case, you’d see
2020-03-29 02:09:22.489149+0100
2020-03-29 02:09:22.489160+0100
2020-03-29 02:09:22.522734+0100 === system wallclock time adjusted
2020-03-29 02:09:22.522749+0100
2020-03-29 02:09:22.522913+0100
as you would obtain that log extract when British Summer Time was already in force.

Converting from Date values stored in log files to strings expressed in local time isn’t something an app would want to repeat constantly, for example on the fly when scrolling through a list of 50,000 entries. LogUI therefore converts each time into text when it fetches those log entries. If you then save the log extract in JSON format, those times remain in that local form, and aren’t converted again if you open that file in a different time zone or seasonal time correction. If you want to retain times in their original format, so they’ll be converted into a later time zone, for example, save the log as a logarchive, to ensure that each time will be converted into text using the local time applicable when the extract is fetched from that logarchive. That should affect few users, and only in unusual situations.

Key points

• The Unified log appears to record times in Mach absolute time, and convert those to wallclock format when accessed.
• By default, the log show command, and apps like Ulbow that use it, give the wallclock time adjusted to local time when each log entry is written. That can result in confusing time sequences.
• LogUI expresses all times in local time when log entries are extracted from the log. That makes its handling of time independent of seasonal changes, and more consistent.
• Periodic wallclock adjustments affect all wallclock times, and may need to be allowed for when measuring times from log entries.

A century ago today, on 16 October 1925, the Norwegian artist Christian Krohg (1852–1925) died. Over the last month I’ve looked in detail at a selection of his paintings and given a brief account of his career and art. This concluding article is an overview to commemorate his death.

Like so many artists of the late nineteenth and early twentieth centuries, Krohg’s paintings were exhibited successfully at the time and were of substantial influence. But they were quickly discarded in the years after the First World War, as European art became overwhelmed by modernism and rejected much of the past. A century later we should now be able to form a better perspective.

As with most Norwegian painters of the day, Krohg trained mainly in Germany, in Karlsruhe and Berlin, ironically in part by the great Norwegian landscape artist Hans Gude. During that, Krohg must have become determined to help build and run a Norwegian state academy so the nation could train its own artists. He also developed an early concern over contemporary society in Norway, in inequality, poverty, the rise of prostitution, and Norway’s independence as a nation. As a writer and journalist, he not only tackled these in paint, but in his novel Albertine (1886) and numerous articles.

Early in his career he travelled to the developing artist’s colony at the northern tip of Jutland in Denmark, in the isolated fishing village of Skagen, the hotbed of Nordic Impressionism. He there started a ten-year project to document the life of one family, the Gaihedes.

Over successive summers, Krohg built a documentary account of their lives in clinical portraits and insights into their everyday routines. In Niels Gaihede Netting (c 1880) he shows them together, with Niels at work on his fishing net, and Ane in the background, staring sternly.

Krohg soon started to teach young artists, first at an art school for women, who were still fighting conservative attitudes persisting in the major academies at the time.

In 1881, with his painting of Sick Girl, he opened a new theme of illness in the family, here a girl who was dying of tuberculosis, then prevalent throughout Norway and much of the rest of Europe. This proved a direct inspiration for a motif taken up early in the paintings of Edvard Munch, who eventually made around twenty variants of the same theme.

At the time, prostitution was illegal in Norway, except in its capital where it was regulated by the police. Krohg was one of many who became concerned at the number of young women who were believed to move from country districts to work as seamstresses in the city, only to find that work too demanding and their income too low, so turned to prostitution.

Krohg’s first novel Albertine was published in 1886 and immediately banned by the police on the grounds of violating the good morals of the people. This tells the story of a young seamstress who ends up a prostitute, an account Krohg turned into several paintings including Albertine in the Police Doctor’s Waiting Room (1885-87). His heroine is the simple and humble country girl at the front of the queue to go into the police doctor for inspection. Behind her is a motley line of women in various stages of decline.

A couple of years later, in his Struggle for Existence (1889) he painted a crowd of poor women and children queueing on Karl Johans Gate, Oslo’s central street, to be handed stale bread to ease their hunger. Three years later this was to be the setting for Edvard Munch’s famous painting of Evening on Karl Johan Street.

He declared his support for Norway’s independence in 17th of May 1893, marking what had been increasingly celebrated as Constitution Day since the signing of the national constitution in 1814. The Norwegian flag shown lacks the ‘herring salad’ badge, so indicating its freedom from union with Sweden, eventually achieved on 7 June 1905.

Throughout his paintings Krohg uses modern close-cropped compositions that may well have been influenced by photography. This is shown well in Reefing the Sails (1900), where two crew are working at a height on a square-rigged sailing ship.

In 1909 he was appointed the first professor and director of the State Academy of Art (Statens kunstakademi), and held the latter post until the year of his death.

Although he explored other themes in his later years, he still returned to the plight of young women toiling long hours at their sewing machines in the garrets of the city. His Seamstress’s Christmas Eve from 1921 offers more optimism that some could be rescued by charity.

Unusually, Krohg even left his own painted obituary in Five to Twelve, one of his last paintings, where he is asleep in a chair underneath a pendulum clock. The face of the clock is completely blank, but the title tells us the time: it is five minutes to midnight.

Krohg retired as the director of the State Academy of Art in 1925, and died in Oslo a few months later, on 16 October.

References

This blog:
Christian Krohg painting social reality 1: to 1883
Christian Krohg painting social reality 2: 1883-88
Christian Krohg painting social reality 3: 1888-95
Christian Krohg painting social reality 4: 1898-1924

Skagens Museum, Denmark
Øystein Sjåstad (2017) Christian Krohg’s Naturalism, U Washington Press. ISBN 978 0 295 74206 9.

Sometimes apps that should run fine seem to find problems where there shouldn’t be any, becoming slow to launch, unable to update, erratic, and easily crashed. One reason that can account for these is that the app has become stuck in translocation. This article explains how you can check that, and what you can do to solve it and restore the app’s normal function.

App translocation, or Gatekeeper Path Randomisation (GPR), is a security mechanism intended to disrupt malicious code that’s dependent on its immediate location, perhaps to access other code in plugins. When a new quarantined app is run from the same folder it came in, it’s copied to a random path that appears as a volume, typically hidden at something like /private/var/folders/x4/[random chars]/T/AppTranslocation/[UUID]/d/, and run from there. However, it’s only present there while it’s running, and the moment you quit the app that location is unmounted, and vanishes.

In theory, translocation shouldn’t affect an app, but when it occurs repeatedly, it’s likely to prevent it from updating itself, and have other adverse effects. When an app has been translocated once, unless something is done to prevent further translocation, it’s likely to suffer the same fate every time it’s run, so becoming stuck in translocation.

Testing

To determine whether an app is being run from translocation, you need to discover the path of its executable when it’s running. That’s simple to do using Activity Monitor:

1. Run the app from the Finder as normal.
2. In Activity Monitor’s CPU view, locate the app in the list of processes, and select it there.
3. Click on the ⓘ tool above to inspect the process.
4. Look at the Executable Path given there.

If the path starts with anything like /private/var/folders/x4/[random chars]/T/AppTranslocation/[UUID]/d/, then the app is being run in translocation.

If you’d prefer to perform this in Terminal instead, run the app, then enter the command
ps xw | grep AppName
to see its executable path. This was suggested by Quinn “The Eskimo!” of Apple’s Developer Technical Support.

Fixing

App translocation occurs when all the following apply:

1. the app has a com.apple.quarantine extended attribute attached;
2. the app must be opened by Launch Services (normally the Finder) rather than a command shell;
3. the app hasn’t been individually moved in the Finder from the folder it was unarchived or downloaded to, wherever that was.

One common error that falls foul of those rules is when two or more apps are moved together from the Downloads folder into Applications, and another is to move an app inside the same folder it came in, into Applications.

Although you can strip the com.apple.quarantine extended attribute from the app, it’s simpler and better practice to:

1. Move the app (one at a time) to another folder in the same volume, then run it from that location.
2. Move the app back to the folder you want to keep it in, preferably in one of the standard Applications folders.
3. Run it again from there and confirm that it’s no longer translocated.

Future updates should then work fine, and the app should be spared any further translocation.

Summary

• If an app isn’t working or updating properly, suspect it might be stuck in translocation.
• Run the app and inspect its Executable Path in Activity Monitor to determine whether it’s being translocated.
• If it is, move it elsewhere, run it, move it back, and check again.

Apple has just released its weekly update to XProtect, bringing it to version 5319. As usual, it doesn’t release information about what security issues this update might add or change.

This version adds three new Yara rules. MACOS.SOMA.OCENA is yet another for the vast Soma/Amos family, and there are two for the far newer MACOS.ODYSSEY group, MACOS.ODYSSEY.SOCGO and MACOS.ODYSSEY.SEENA.

You can check whether this update has been installed by opening System Information via About This Mac, and selecting the Installations item under Software.

A full listing of security data file versions is given by SilentKnight and SystHist for El Capitan to Tahoe available from their product page. If your Mac hasn’t yet installed this update, you can force it using SilentKnight or at the command line.

If you want to install this as a named update in SilentKnight, its label is XProtectPlistConfigData_10_15-5319

Sequoia and Tahoe systems only

This update has already been released for Sequoia and Tahoe via iCloud. If you want to check it manually, use the Terminal command
sudo xprotect check
then enter your admin password. If that returns version 5319 but your Mac still reports an older version is installed, you should be able to force the update using
sudo xprotect update

Patronage is bad for art, particularly for paintings. Whether they come in the form of commissions for churches or by the powerful and wealthy, paintings to please others are inevitably constrained by what those others want to see. Until the seventeenth century, there were remarkably few depictions of ordinary, everyday people. Then, at about the same time, that changed in paintings by the likes of Bartolomé Esteban Murillo (1617–1682) in Spain, and the Brueghel family and David Teniers the Younger (1610–1690) in Brabant to the south of the Dutch Republic. In the Dutch Golden Age such paintings rose to popularity, and must have graced the walls of many Dutch homes. This article looks at a small selection of those that have survived.

Portraits of women washing linen first became popular in Dutch and Flemish ‘cabinet’ paintings, such as Gabriël Metsu’s Washerwoman (c 1650), along with other scenes of household and similar activities. This painting appears authentic and almost socially realist: the young woman appears to be a servant, dressed in her working clothes, with only her forearms bare, and her head covered. She’s in the dark and dingy lower levels of the house, and hanging up by her tub is a large earthenware vessel used to draw water. She looks tired, her eyes staring blankly at the viewer.

Metsu’s Kitchen Maid from 1656 is preparing a trussed-up chicken to be roasted on a metal skewer over an open fire. Behind her, hanging from a hook, is a small furry mammal probably intended to be a rabbit, although it worryingly looks more like a very large cat. Below it in the otherwise empty fireplace is a bowl of what look like potatoes.

Metsu followed his subjects beyond the home, here into The Vegetable Market in Amsterdam in about 1660-61. The mistress stands with a metal pail on her arm, detached from the housekeeper to the left of centre, who is bargaining with one of the vendors. Other figures are drawn from a broad range of classes, and there’s produce ranging from cauliflowers to chickens.

His Woman Selling Herring (c 1661-62) is going from door to door with her fish, here trying to convince an old woman standing with a stick at the door of her dilapidated cottage.

Out in the country, Metsu finds The Pancake Baker with a Boy (1655-58), again with fascinating detail. The cook in her roadside tent offers an impressive menu, with fish being supervised by a watchful cat, pancakes cooked to order from the batter in the earthenware pot by the woman’s left leg, and a few apples. Her trade seems to extend to shellfish too, with what appears to be a lobster peering from a wickerwork basket on the table, and a couple of empty mussel shells underneath it. This is the Dutch equivalent of the Spanish bodegone, popular in the earlier years of the century, and successfully painted by Velázquez early in his career.

Several of Vermeer’s masterpieces depict ordinary people in everyday life, among them his Milkmaid from about 1658-1661.

A maid is pouring milk from a jug, beside a tabletop with bread. In the left foreground the bread and pots rest on a folded Dutch octagonal table, covered with a mid-blue cloth. A wicker basket of bread is nearest the viewer, broken and smaller pieces of different types of bread behind and towards the woman, in the centre. Behind the bread is a dark blue studded mug with pewter lid, and just in front of the woman a brown earthenware ‘Dutch oven’ pot into which she is pouring milk.

Figures in the animal paintings of Paulus Potter and Gerard ter Borch were also thoroughly ordinary.

Paulus Potter’s Peasant Family with Animals (1646) shows a family with a curiously grotesque young daughter, their cottage, and some wizened trees.

Potter was reticent about showing milkmaids, though. In his Cows Grazing at a Farm, painted in 1653, the year before his early death, the milkmaid is almost hidden by the cow’s hindquarters.

Gerard ter Borch was prepared to put the milkmaid and her cow at the centre of this painting, A Maid Milking a Cow in a Barn from about 1652-54. As was universal at the time, milk was collected in a wooden bucket.

Isaac Koedijck is a bit more unusual in his Surgeon Tending a Peasant’s Foot (1649-50), with its wooden spiral staircase and collection of weapons and tools mounted high on the wall.

It’s easy to mistake Pieter de Hooch’s A Woman Drinking with Two Men from about 1658 for a Vermeer, and like the latter he decorates the far wall with a contemporary map. The Eighty Years’ War had not long ended, and the Dutch Republic was flourishing. Discarded objects are scattered on its black-and-white tiled floor. There’s a large and empty fireplace, and above it hangs a religious painting.

Finally, Gabriel Metsu’s Old Drinker (c 1650-67) is dressed in clothes almost as old as he is, and clutches a clay tobacco pipe in his right hand, and a pewter drinking tankard with his left.

How many of those paintings would have been commissioned by a patron?

Some who use SilentKnight for the first time discover that their Mac has been running for months with one of its security systems disabled. As macOS doesn’t have a dashboard to warn you of such dangerous settings, you may not notice until it’s too late. This article explains how to check those essential security settings on Macs with T2 or Apple silicon chips, and how to put them right. Intel Macs without T2 chips are different, and are covered in a previous version.

Secure Boot

Running your Mac in Full Security ensures it gets full protection from its Secure Boot technology. In an Apple silicon Mac this prevents it from loading third-party kernel extensions, and requires recent approved versions of macOS. Check this in System Information by selecting the Controller item in its Hardware section, or in SilentKnight.

This is controlled in Startup Security Utility, accessed from Recovery. Note that it only works with the paired Recovery system, the one you normally use; Apple silicon fallback Recovery doesn’t have this ability.

If you need to run kernel extensions or other software that can’t be loaded in Full Security, use Startup Security Utility to set the Mac to Reduced Security, and enable kexts. Avoid doing this if at all possible.

Settings are different for Intel Macs with T2 chips, where there are three levels of boot security, and the most common reason for reduction from Full Security is to enable that Mac to boot from external drives, something that Apple silicon Macs can do in Full Security.

System Integrity Protection (SIP)

Since El Capitan, macOS has protected all its system files, even down to bundled apps, using System Integrity Protection. This should make it impossible for malware or other software to change those protected files. SIP is also required for a wide range of other security protection, and should be fully enabled unless you have a compelling reason for disabling it partially or completely. In Apple silicon Macs, its status is reported in System Information’s Controller item, but Intel Macs instead give it in the Software section. It’s also checked by SilentKnight and Skint.

You can turn SIP off, something very occasionally needed to perform certain essential tasks. Doing so requires you to start up in Recovery mode, enter a command in Terminal there, and restart; Apple silicon Macs also need to have their boot security reduced in Startup Security Utility before SIP can be disabled.

To enable SIP, start up in Recovery mode, open Terminal, and type the following command:
csrutil enable; reboot
Once that’s done your Mac will restart in normal mode, and you should confirm that SIP is reported as enabled.

If you ever do need to disable SIP, do yourself a favour and put a sticky note on your Mac’s display to remind you to turn it back on.

Gatekeeper/XProtect

Gatekeeper runs checks on apps when they’re opened, and those can include scans for known malicious software using XProtect. As part of your Mac’s frontline protection against malware, you should leave those enabled unless there’s a compelling reason to temporarily disable them. However, I don’t know of anywhere in the macOS GUI that informs you whether these checks are being performed, although they are reported by SilentKnight and Skint.

If it has been disabled, you may be able to enable it using the command
spctl --enable
but chances are that you will instead need to invoke
sudo spctl --global-enable
requiring you to authenticate using your admin password. Be careful with those commands: the hyphens before enable and global-enable aren’t long dashes, but two separate hyphens.

Signed System Volume (SSV)

When you install Big Sur or later, the vast majority of its system files are saved in its System volume. For your Mac to boot from this, it has to be turned into a snapshot, sealed using a tree of cryptographic hashes, and the master seal ‘signed’ by a hash, which is compared against that set by Apple. This signed system volume is extremely secure and thoroughly reliable. On Intel Macs, this is only reported in Disk Utility, but Apple silicon Macs list it in System Information as well. It’s also reported by SilentKnight and Skint.

The SSV should always be enabled. If it isn’t, you’ll need to re-install macOS.

FileVault

Intel Macs with T2 chips and Apple silicon Macs encrypt the whole of the Data volume on their internal SSD. By default, that uses an internally-generated key that’s used automatically when any user logs in. Although it provides good security in most situations, you’re far better off enabling FileVault, as that protects the encryption key with your password as well. This imposes no overhead on accessing encrypted data, and provides valuable protection for your data at no cost.

Check whether FileVault is enabled in Privacy & Security settings, where you can enable it if it’s not already turned on. SilentKnight checks it as well.

macOS and firmware

To ensure your Mac and its apps are best protected from malware, keep its firmware and macOS up to date. As those are updated together, Macs with T2 or Apple silicon chips that are running the most recent release of their major version of macOS will also be running the current firmware, which no longer needs to be checked separately. Check the version of macOS in the About This Mac command at the top of the Apple menu.

Apple lists current supported versions of macOS on its Security Releases page. Those, and versions of security data software, are also listed and detailed here on this page.

If your Mac is running an older release of macOS and its firmware, update them together using Software Update in General settings.

XProtect Remediator scans

This anti-malware scanner performs automatic background scans to detect and remove a wide range of malicious software. It’s normally scheduled to run at least once a day, when your Mac is awake but not busy, and supplied with mains power. You’re wise to check that its scans are being run correctly, and will probably want to know if it has detected and remediated any malware. SilentKnight and Skint run a quick check of its activity over the previous 36 hours, and XProCheck provides detailed reporting and analysis.

Over the last year or so, XProtect Remediator has been using a timer during its scans, and automatically cancelling them if a scan takes longer than allowed. On many Macs, most scans are terminated early, and that results in warnings from SilentKnight and Skint. If you’re concerned, check the reports in XProCheck, where you’ll see that plugin was cancelled with a status_code of 30, as is typical with the timer.

Check:

• the Mac boots in Full Security, if possible,
• SIP is enabled,
• Gatekeeper/XProtect is enabled,
• it has booted from an SSV,
• FileVault is enabled,
• it’s up to date with macOS,
• XProtect Remediator scans are taking place daily.

SilentKnight does all of those and more.

We’re remarkably good at perceiving different surface textures, but find it harder to imagine them in two-dimensional images. While the overwhelming majority of paintings, at least until the twentieth century, consist of a paint layer on a flat ground, there’s nothing that requires the surface of the paint layer to be flat and smooth. But if all you look at are images of paintings, you generally won’t see their surface texture, where the artist has applied and shaped paint in thick layers of impasto, or incised into some of the layer in sgraffito. This article looks in detail at four examples where surface texture in the paint layer is important.

Arnold Böcklin’s unusual painting of Sirens from 1875 was made in tempera on canvas, with the ground and paint layers thin enough to let the texture of the canvas weave show through. This image was fortuitously taken with lighting that allows the texture to show.

Another famous tempera painting wasn’t painted on a textured ground, but is one of the earlier paintings to feature impasto as a technique.

The Wilton Diptych was painted on two small panels of oak wood in the final years of the fourteenth century. That wood was first assembled into the panels, then carved down from a thickness of about 2.5 cm (1 inch) to form an integral frame with a recessed painting surface. A smooth gesso ground was then laid on the wood before the gilded areas were laid onto it using thin sheets of gold leaf, and patterned using a range of punches.

Details of jewels and similar objects such as the white hart brooches were raised using thicker areas of lead white paint, to give the impression of enamelling. Coupled with mordant gilding, they mimic the three-dimensional form of jewels and act as point reflectors of light, sparkling as if they really were gems in the paint layer, as shown in the details above and below.

The finest strokes of paint seen here are less than 0.5 mm (1/50th of an inch) across.

From those early days of modern painting until the decline of ‘academic’ painting in the late nineteenth century, patrons, Salon juries and critics expected paint surfaces to be smooth and flat. But there were rebels.

Many of Rembrandt’s paintings from before 1650 have fairly conventional ‘finished’ surfaces, his monumental Night Watch being a good example. By about 1660, though, many of his paintings had quite rough surfaces that significantly alter their optical properties.

One of the best examples of Rembrandt’s use of texture in the paint layer is The Jewish Bride from about 1667, just a couple of years before his death. This is among his works studied by the Rembrandt Research Project.

In this detail, highlights on the sleeve and jewellery have been applied roughly, although it’s still a matter for speculation as to exactly how he achieved that. Lower down, on the red dress of the bride, the duller top layer of paint has been scraped through to reveal lighter lower layers. The end result is a painting that creates its visual effects as much by its surface textures, as by form or colour.

One of Rembrandt’s secrets that have been sought by so many since lies in how he was able to exploit surface texture in his paint. That is the ‘secret recipe’ which Maroger, Redelius, and others claimed to have discovered. Systematic analyses of Rembrandt’s paint layers by White at the National Gallery in London and the Research Project soundly rebutted the ‘secrets’ claimed. In the main, Rembrandt used linseed oil as his binder, occasionally using walnut oil as well, and just once poppy seed oil.

In some passages the oil had been thickened by heat treatment, but this was by no means widespread. Traces of pine resin found in some samples may have been introduced during retouching, and don’t appear to be a feature of Rembrandt’s impasto work; neither is there any evidence that he added wax to his oil paint to give it body, as some had asserted.

As you might expect, JMW Turner was another such rebel.

For example, in his Seapiece with Fishing Boats off a Wooden Pier, a Gale Coming In, possibly from as early as 1801, Turner made extensive use of sgraffito, made using a knife, brush handle, or even his fingernails for all we know.

Later that century, Vincent van Gogh developed a more radical approach, in his initial version of Wheat Field with Cypresses from 1889, the year before his death.

It’s possible that he completed this painting in a single sitting, as this seems to have been intended as an oil sketch for a more finished version which he painted later that summer.

The detail above shows the tops of the wheat towards the lower left of the field, in the foreground. Over his initial thin layers of paint, van Gogh laid thick gestural strokes of highly chromatic paint, orientating those strokes according to the object they show. In the golden yellow of the wheat there are blues and greens, mostly showing through from his underpainting, with superimposed impasto of pale straw, ochre, and pale greens.

This detail, taken from the edge of the wheatfield at the lower right corner of the painting, shows three distinct areas of brushwork: the diagonal strokes forming the standing wheat, swirling loops to form the grasses and weeds below, and shorter marks forming a more random pattern for the heads of the wheat in the upper section.

At the centre of the canvas, from where this detail is taken, impasto blue and white have mixed with the green and yellow of the fields below. This shows that much of the painting was painted wet on wet, either in the same session or on consecutive days. Some of the darker green at the right may have been painted later, onto paint that had by then become touch dry.

An X-ray image of the whole painting shows in white those passages likely to contain the most lead white, and some other pigments which are most radio-opaque. This also reveals the pattern of brushstrokes well.

With the introduction of acrylic paints in the latter half of the twentieth century, painters have been able to apply even heavier impasto, and some have used this to paint what are in effect reliefs.

This is why so many paintings have to be seen in the flesh, up close, and in the right light for their full appreciation.

The greatest challenge in using the Unified log is how to navigate its many thousands of entries, to find those you want to read. Success depends on the combination of two aids: time and waypoints (or landmarks).

Time

No matter how you obtain log extracts, you need to know when to look for those entries. The more precisely you can work out the time of interest, the quicker and easier it will be to locate the entries you’re interested in. While the log command offers alternatives, LogUI works throughout using the local time applicable when you access the log, allowing for your current time zone and any seasonal adjustment to it, when accessing the live log in that Mac.

However, the underlying times given in log extracts are those recorded by the Mac or device whose log you’re accessing. If its system clock was five minutes slow when those entries were written to its log, then you need to allow for that. For example, when I first started my Mac yesterday its clock might have been 1 minute slow. An event that occurred at 10:56 yesterday by the room clock would therefore appear in the log entries for 10:55.

One important time you can discover is the boot time of the Mac. Mints offers a Boot button to retrieve boot times over the last 24 hours. If the logs were written by a different Mac or device, then you’ll need to search for the time of that last boot. Fortunately the first two log entries are easily recognised:
11:41:37.562774+0100 === system boot: D3CEA9B4-F045-434D-8D12-C6E794A02F14
11:41:42.758780+0100 kprintf initialized
The long gap between the first two entries is accounted for by the firmware phase of the boot process. If necessary you can search for a message containing === (three equals signs). Mints provides the time of the first of those for each boot, and its UUID.

There are two occasions when time can become confusing, when clock corrections are applied, and when clocks are moved forward or back to add or remove summer or seasonal time changes. Fortunately the latter only change twice each year, although when they do, you really don’t want to see what happened in the log, and those changes aren’t even applied at a predictable time.

Clock corrections, like kernel boot, are readily found by the === text in their message. They normally happen in pairs, with the first correction the larger, and the second often far smaller. Here’s an example seen in consecutive log entries:
08:26:16.140474+0100 /usr/libexec/sandboxd[80] ==> com.apple.sandboxd
08:26:10.043353+0100 === system wallclock time adjusted
08:26:10.044335+0100 Sandbox: distnoted(72) deny(1) file-read-metadata /private
08:26:10.044601+0100 2 duplicate reports for Sandbox: distnoted(72) deny(1) file-read-metadata /private
08:26:10.044606+0100 Sandbox: distnoted(72) deny(1) file-read-metadata /Library
08:26:10.089204+0100 === system wallclock time adjusted
08:26:10.091850+0100 started normally

The first adjustment dropped the clock back by 6.1 seconds, from 08:26:16.140474 to 08:26:10.043353. This means that you’ll see times of 08:26:12 both before the correction and afterwards. The second adjustment, from 08:26:10.044606 to 08:26:10.089204, was far smaller at 0.045 seconds, and at least went in the right direction.

The most substantial clock corrections are made shortly after booting. Although macOS does make them later, the size of those should be smaller.

Waypoints

Even working with times resolved to the second, those can still leave you browsing thousands of log entries. To locate more precisely you need details of one or more entries that will be sufficiently distinctive to focus in on a few dozen. These are waypoints for navigation.

LogUI provides three methods for locating these waypoints:

• using a search predicate to determine which log entries are extracted from the log;
• applying search text to filter out all entries that don’t contain a term;
• searching a rich text export of the log extract.

Predicates

These are best used when the time period of your extract needs to be relatively long, so would return a large number of entries. For example, if you can only narrow the time down to several minutes, and are looking for the time that a specific app was launched, you can look for that app’s job description when it’s created and written to the log by RunningBoard.*

Over a period of two minutes, RunningBoard might write thousands of entries in the log, so looking for your app’s job description among them would be time-consuming. Set the start time and period to cover the whole of the time you want to search, then set a predicate for the subsystem com.apple.runningboard.

When LogUI fetches that log extract, there might still be over 2,000 entries, so now is the time to apply search text to filter those further.

Search filter

To filter those 2,000 entries and show only those containing job descriptions created by RunningBoard, enter the text constructed job in LogUI’s search box, with its menu set to Messages, and press Return. You’ll now see that list reduced to just a handful, and looking through them you can discover exactly when your waypoint occurred.

My example for this article starts with a period of just 2 minutes, in which there were more than 100,000 log entries.

Using the com.apple.runningboard predicate whittled those down to 13,443 entries.

Searching within those for constructed job left me with just 8 entries to look through.

Search rich text

Sometimes you can’t devise the right combination of predicate and search filter to discover what you’re looking for, which might be an error reported in a subsystem or a process that you can’t identify. One good way forward is to narrow your log extract as much as you can, then save the extract as Rich Text, open that in a suitable editor, and search through it for the word error. That will discover every log entry containing the word error anywhere, rather than confining it to the message text.

Using time and waypoints

Armed with your waypoint and the exact time of its entry in the log, you can now set that as the start time, set a period of a couple of seconds, and get a full log extract containing all the detail you might need. This should give you further clues to allow you to move through time using predicates and search filters to discover what happened. This is much quicker and less frustrating than trying to scan through thousands of log entries in search of vague clues.

Key points

• Use time and waypoints to find log entries.
• Mints’ Boot button gives times of each boot in the last 24 hours.
• Reduce the number of log entries returned using a predicate.
• Narrow those down using a search filter.
• Search all text by exporting the log extract as Rich Text.

* Sadly, the days of being able to access freely RunningBoard’s informative job descriptions in the log are over. As of macOS Tahoe, all you’ll see is the dreaded <private> of censorship. If you want to examine these now, you’ll have to remove log privacy protection first. Thanks, Apple, for providing such useful tools then rendering them next to useless.

After they have talked with the notorious thief Vanni Fucci, Dante and Virgil move on and meet a centaur, identified by Virgil as Cacus, who had been killed by Hercules. Dante’s classical reference here is a little strange in that he gives an account of the killing of Cacus according to Livy, rather than Virgil’s version in his Aeneid.

The centaur flees, leaving the pair to meet three more tormented souls. A lizard-like creature then attaches itself to one of them named Agnello, a member of a prominent Florentine Ghibelline family, and their two bodies become one. Another is pierced by a serpent through his navel, and Dante witnesses other horrific reptilian transformations.

Having found five citizens of Florence in this rottenpocket of Hell, Virgil leads Dante through shattered rock to the eighth, where each of the souls is burning with fire in the pit in return for their fraudulent lives.

Virgil explains that among them are Ulysses and Diomedes, who are united in a single flame, telling an invented story of their final and fateful voyage. Dante didn’t have direct access to Homeric accounts of the adventures of Odysseus, so based this on Virgil’s contrasting retelling of the deception of the Trojan horse.

After that, another flame identifies itself as Guido da Montefeltro, and relates some of its life as a sly Ghibelline military leader who later repented and became a Franciscan friar.

Virgil takes Dante on to the ninth rottenpocket, where those who used fraud to incite division are suffering for their crimes. The gruesome sight awaiting them here is of gross mutilations, bodies chopped up and torn apart so that their organs spill out. They meet a succession of dismembered and dissected spirits, including Mosca de’ Lamberti, both of whose hands have been cut off. He had been responsible for creating the rift between Guelphs and Ghibellines that scarred Florentine history for so long. Another body passes by carrying its severed head like a lantern from one of its hands. The head tells them that he is Bertran de Born, a Provençal troubadour who sowed discord between King Henry II of England and his son Prince Henry.

Dante is so astonished by this display of butchery that he stands and stares at the bodies, but Virgil reminds him that they must move on.

The pair then reach a viewpoint over the last of the rottenpockets, from which arises a foul smell. The souls there are all covered with festering sores and scabs, and can only crawl over one another.

There they hear the story of Capocchio, an alchemist who falsely claimed to be able to transform base metals into gold.

The artists

William Blake (1757–1827) was a British visionary painter and illustrator whose last and incomplete work was an illustrated edition of the Divine Comedy for the painter John Linnell. Most of his works shown in this series were created for that, although he did draw and paint scenes during his earlier career. I have a major series on his work here.

Gustave Doré (1832–1883) was the leading French illustrator of the nineteenth century, whose paintings are still relatively unknown. Early in his career, he produced a complete set of seventy illustrations for translations of the Inferno, first published in 1857 and still being used. These were followed in 1867 by more illustrations for Purgatorio and Paradiso. This article looks at his paintings.

John Flaxman (1755–1826) was a British sculptor and draughtsman who occasionally painted too. When he was in Rome between 1787-91, he produced drawings for book illustrations, including a set of 111 for an edition of The Divine Comedy. In 1810, he was appointed the Professor of Sculpture to the Royal Academy in London, and in 1817 made drawings to illustrate Hesiod, which were engraved by William Blake.

Jan van der Straet, also commonly known by his Italianised name of Giovanni Stradano (1523-1605), was a painter who started his career in Bruges and Antwerp in Belgium, but moved to Florence in 1550, where he worked for the remainder of his life. Mannerist in style, he worked with printmakers in Antwerp to produce collections of prints, including an extensive set for The Divine Comedy.

References

Wikipedia
Danteworlds

Robin Kirkpatrick (trans) (2012) Dante, The Divine Comedy, Inferno, Purgatorio, Paradiso, Penguin Classics. ISBN 978 0 141 19749 4.
Richard Lansing (ed) (2000) The Dante Encyclopedia, Routledge. ISBN 978 0 415 87611 7.
Guy P Raffa (2009) The Complete Danteworlds, A Reader’s Guide to the Divine Comedy, Chicago UP. ISBN 978 0 2267 0270 4.
Prue Shaw (2014) Reading Dante, From Here to Eternity, Liveright. ISBN 978 1 63149 006 4.

I hope that you enjoyed Saturday’s Mac Riddles, episode 329. Here are my solutions to them.

1: Two credentials or 762 should be superseded by passkeys.

2: Notably from Autodesk but once by Claris, it’s 3,245.

3: From the Mac II until replaced by USB, 2,779 was quite enough.

The common factor

I look forward to your putting alternative cases.

One of the longstanding oddities in macOS security has been scanning of a notarized app by XProtect before it can be launched. When apps are submitted to Apple for notarization, they’re scanned for malicious content using methods at least as effective as XProtect, and should any notarized software subsequently be identified as malicious, its notarization and signature are revoked immediately. That should make it impossible for any app with a valid notarization ticket to contain malware known to Apple.

One of the improvements believed to be incorporated into macOS 26 Tahoe is that validly notarized apps are no longer scanned by XProtect. When I examined this recently, I confirmed that was correct, although in practice this did little if anything to improve the launch times of apps. This article extends those observations to include app first run, when detection of malware is most critical.

When an app is run for the first time in a recent version of macOS, there are three options:

• apps that aren’t quarantined, including those signed by Apple and almost all of those supplied through the App Store, normally don’t undergo additional checks;
• quarantined apps that have been installed correctly undergo full first run checks, that have previously included XProtect scans;
• quarantined apps being run from the immediate location they arrived in not only undergo full first run checks, but are additionally moved to be run from a random path in what’s commonly known as app translocation, or Gatekeeper Path Randomisation (GPR).

This article considers the second and third of those.

Quarantined first run, no translocation

In Sequoia 15.7 these apps undergo a “direct malware and dylib scan” using the XProtect data stored in its new location, in /var/protected/xprotect/XProtect.bundle. Because this is the first run, once Gatekeeper assessment is complete and confirms the app is safe to run, the user is presented with a dialog asking for their consent. Because of the inevitable delay in responding to that, two times can provide meaningful estimates of performance:

• the time between the log entry reporting that Gatekeeper is performing a scan (“GK performScan”), and declaring the Gatekeeper scan complete (“GK scan complete”), in this case 5.35 seconds;
• the time between the start of the XProtect scan (“Xprotect is performing a direct malware and dylib scan”) and the declaration of scan results (“GK Xprotect results”), here 5.33 seconds.

In Tahoe 26.0 no XProtect scan was attempted, as com.apple.xprotect entered in the log “Xprotect is skipping executable assessment”, and com.apple.syspolicy.exec confirmed “Skipping XProtect scan on seen software”. Despite that, the first of those times was nearly twice that required in Sequoia, at 10.29 seconds. The reason for this is unknown, but over that period the log contained about 13,000 entries reporting “SecKeyVerifySignature”.

As a result, a smaller and simpler app was used to test app translocation and its effects.

Quarantined first run, with app translocation

Instead of using Calibre as my test app here, I chose my own app Podofyllin, with its 442 KB executable and no dylibs or other complications. This was downloaded from here, unarchived automatically in the ~/Downloads folder and there run from the folder it came in, to ensure that it would be translocated.

Early in the launch sequence, com.apple.securityd writes a log entry indicating it has created the translocation directory “SecTranslocateCreateSecureDirectoryForURL”, following which diskarbitrationd replicates the app bundle to what appears as a different volume in the translocation path. Then a first run Gatekeeper assessment is performed, including an XProtect scan, checking the notarization ticket using CloudKit, a user approval dialogue, and setting up the app’s provenance tracking.

In Sequoia 15.7, the XProtect scan took 0.15 seconds, and the total period required for the Gatekeeper scan was 0.19 seconds.

In Tahoe 26.0, com.apple.syspolicy.exec logged “Skipping up front XProtect scan” and com.apple.syspolicy went straight on to perform the CloudKit lookup. This was confirmed later by com.apple.syspolicy.exec in “Skipping XProtect scan on seen software” just before reporting the Gatekeeper scan was complete. With no time required for the XProtect scan, the total used for the Gatekeeper scan was 0.16 seconds, 88% of that for Sequoia.

Stuck in translocation

Over the last couple of years it has become clear that some apps, even though they have been moved from their original download location, continue to undergo translocation whenever they’re run, and that can cause ongoing problems.

An app will be translocated if all the following apply:

1. the app has a com.apple.quarantine extended attribute attached;
2. the app must be opened by Launch Services (normally the Finder) rather than a command shell;
3. the app hasn’t been individually moved in the Finder from the folder it was unarchived or downloaded to, wherever that was.

Tests in recent macOS show that apps won’t be translocated if:

• they have no com.apple.quarantine extended attribute, or it has been removed;
• they have been moved individually in the Finder so they’re now enclosed in a different folder.

The following will normally result in the app being run in translocation:

• opening the app in the folder that it first arrived in, even if that folder has been moved elsewhere, such as into an Applications folder;
• moving the app at the same time as other apps, even if they’re all put into an Applications folder. Group or simultaneous moves in the Finder aren’t counted as a move that will stop future translocation;
• running the app again without moving it from a location from which it has already been translocated. Until the app is moved from that location, it’s likely to be repeatedly translocated every time that it’s run.

You can readily check whether an app is being run in translocation by starting the app and either:

• inspecting that app in Activity Monitor, by selecting it in the CPU view and clicking on the ⓘ tool,
• running ps xw | grep AppName in Terminal.

If the path shown for the app is something absurdly long like /private/var/folders/x4/[random chars]/T/AppTranslocation/[UUID]/d/, then it has been translocated.

If an app that appears to have been correctly installed is still being translocated, move it individually (one app at a time) from the folder it’s currently in to a different folder, run it from there, close the app, and move it back to where you want to keep it.

Conclusions

• macOS 26.0 Tahoe skips reported XProtect malware scans when a notarized app is run for the first time in quarantine, even when it has been translocated.
• Despite that, first run checks in Tahoe can still take significantly longer than in subsequent runs, although the reason for that isn’t clear from the log.
• If an app doesn’t appear to run properly, check whether it’s stuck in translocation. If so, free it as explained above.

By the early 1860s, the large and ancient Forest of Fontainebleau, to the south-east of Paris, had been attracting those of the Barbizon School, who painted realist landscapes in front of the motif. The next generation started visiting in 1865, and went on to form the French Impressionists.

In May 1865, the young Frédéric Bazille left the city of Paris for the Forest of Fontainebleau, where he painted Landscape at Chailly (1865) in company with Claude Monet, and possibly Auguste Renoir and Alfred Sisley. Although clearly influenced by the Barbizon School, his colours are much brighter, and escape the rather sombre browns and greens that dominated much of the work of that earlier art.

Sisley painted this Avenue of Chestnut Trees in La Celle-Saint-Cloud to the west of the forest in 1865, again in Barbizon style. He didn’t submit it to the Salon until 1867, when it was refused. It then remained unsold for ten years before being bought by Sisley’s patron Jean-Baptiste Faure, a celebrated opera singer.

The following year, Sisley walked through the forest with Renoir. He then stayed in the village of Marlotte, where Renoir, Monet, Bazille, Pissarro and Cézanne also visited to paint.

Sisley was more successful with Women Going to the Woods, completed in 1866. This was one of his two paintings exhibited at the Salon that year, and shows the main street in the village of Marlotte with a little rustic staffage.

Clearing in the Woods (1865) is Renoir’s first substantial (surviving) landscape painting, and shows strong influence from Corot. He adopts quite a detailed realist style in this view of a clearing in the midst of massive chestnut trees. These are believed to be near the small village of La Celle-St-Cloud, to the west of Paris not far from Bougival, rather than in the forest. It’s likely that he painted there in the company of Alfred Sisley, who made two views of the same site in very different style.

The following year Renoir painted his friend Jules Le Coeur and his Dogs in the Forest of Fontainebleau. This is unusual among his works, as it was preceded by two studies, and all three were made using the palette knife rather than brushes. This makes it most likely to have been painted before Renoir abandoned the knife and returned to the brush, by the middle of May 1866.

The following year Abbott Handerson Thayer, an American artist who trained in Paris, painted this wonderful oil sketch of Landscape at Fontainebleau Forest (c 1876). This is probably the loosest and most Impressionist painting of his career.

At some time in the late nineteenth century, the wealthy industrialist, amateur painter and patron of Impressionism, Henri Rouart painted In Fontainebleau Forest. This may have been inspired by Corot, but is a realist study in light, shade, and the texture of bark.

John Ferguson Weir was another American painter who had trained in Paris, and became the first director of the School of Fine Arts at Yale University. He visited in about 1902, when he painted Forest of Fontainebleau (c 1902), with its tiny solitary figure against the fallen trunk.

In 1867 Théodore Rousseau died in the village of Barbizon, and he was followed in 1875 by Jean-François Millet. By the twentieth century the forest had fallen out of favour with the new generation.

Among the foundations of visual design are two essential insights, into understanding human vision, and the experience gained from our long history of visual communication. Common to both is the importance of tone (brightness, lightness, etc.) and its contrasts. Not only do around one in twenty males struggle to distinguish some or most colours, but all of us rely on tone to interpret what we see in the absence of information from colours.

This has been illustrated throughout the history of visual art, where those who have excelled in visual communication have placed particular emphasis on tone. Consider Lucas Cranach the Elder (1472–1553) as an example of proven classical methods.

We know a lot about the tonal modelling that Cranach used in his Martyrdom of Saint Catherine painted in 1504-5, through the infra-red reflectogram below, which effectively looks through the paint layer at the underdrawing beneath.

Cranach’s assistants first laid a thin layer of light reddish imprimatura on the white ground of this panel. Once that had dried thoroughly, Cranach himself would have laid down the underdrawing using a pointed brush with carbon black ink. This extended to the tonal modelling shown clearly in the reflectogram.

Following that came undermodelling using grey tones of carbon black and lead white. Some of the darker garments were preceded by a local underpainting of black, a technique popular at the time for dark red fabrics in particular. Much of this seems to have been completed quickly, probably within a single day.

A common practice among masters discards colour altogether and builds the image using tone alone, known as grisaille.

Three centuries after Cranach, the great French illustrator and painter Gustave Doré (1832–1883) painted a group of three works about the Franco-Prussian War entirely in grisaille. Best known among those is The Enigma (souvenirs de 1870), from 1871.

Even a few minutes exposure to a screenful of macOS Tahoe’s windows demonstrates how its new design goes out of its way to ignore those essential insights, and present us with controls that are either bleached- or blacked-out depending on our choice of appearance mode.

In light mode, with default transparency, tool icons and text are clearly distinguished tonally, as are some controls including buttons and checkboxes. However, text entry fields are indistinguishable from the background, and there’s a general lack of demarcation, particularly between the controls and the list view below.

Oddly, dark mode outlines some controls better than light mode, but text entry fields and the list view below still lack demarcation.

One popular mitigation to this lack of tonal contrast is to resort to an Accessibility control that purports to reduce transparency rather than increasing contrast, although in fact its main advantage in Tahoe is to improve tonal contrast, at least in the toolbar.

This still has no effect on controls below the toolbar, and fails to demarcate text entry fields or the list view below.

The elephant in macOS Tahoe is its ignorance of human vision and our long experience of visual communication. It’s an elephant that comes in two appearance modes, bleached-out white or blacked-out black. It has little if any impact on the interface of Apple’s other OS 26es, but it makes macOS a pain to look at and harder to use. I feel sure that Lucas Cranach the Elder, Gustave Doré and every other self-respecting visual artist would be equally offended.

The Forest of Fontainebleau covers an area of about 250 square kilometres (almost 100 square miles) to the south-east of Paris. It’s mixed deciduous woodland, much of it ancient, with a royal castle at its centre. Around the edge of the forest are several small villages that have attracted painters since the early nineteenth century, and inspired two schools of painting: Barbizon, named after the village where most of its adherents gathered, and Impressionism. This weekend I show some of their paintings, starting today with examples from the Barbizon period up to the early 1860s.

The forest has been a favourite hunting ground for French kings, and for the Emperor Napoleon.

Among the paintings of François Flameng showing the Napoleonic period, one of the most striking is this scene of Napoleon Hunting in the Forest of Fontainebleau, where the pack is closing in on a cornered stag as the sun sets.

The royal castle, Château de Fontainebleau, was later used by Napoleon III for receptions.

Jean-Léon Gérôme articulated Napoleon III’s aspirations for empire in his elaborate formal painting of the Reception of Siamese Ambassadors by Napoleon III (1864), depicting the grand reception held at Fontainebleau on 27 June 1861. Gérôme attended in the role of semi-official court painter, made sketches of some of the key figures, and was further aided by photographs made by Nadar. He also included himself, and the older artist Ernest Meissonier (1815-1891), in the painting: I believe that they are both at the back, at the far left.

Achille Etna Michallon was one of the first great landscape artists to paint en plein air in the forest. His study of The Fallen Branch, Fontainebleau from about 1816 anticipates the Barbizon School in its motif, style and location. This large branch looks more like a dying animal.

A decade later, the British artist Richard Parkes Bonington visited briefly and both sketched and painted In the Forest at Fontainebleau (c 1825). The rocks here are particularly painterly, suggesting that this may have been started, if not completed, in front of the motif.

Towards 1830, inspired by the paintings of John Constable, several young French landscape painters started visiting the forest. The first was probably Camille Corot, who first painted there in 1822, and returned in earnest in the Spring of 1829, after his long stay in Italy to learn plein air painting technique in the Roman campagna.

In Corot’s Fontainebleau Forest (The Oak) from about 1830, the twisted limbs of the oak have taken time and care, sufficient to give texture and shadows to the trunks and branches. Where the canopy is more broken he painted the leaves in considerable detail.

Corot was joined by Théodore Rousseau, Constant Troyon, Jean-François Millet, Paul Huet, and later Charles-François Daubigny and Henri Harpignies. Although many of their paintings were made in the forest, few have been located with certainty.

When Harpignies was on the edge of the Forest of Fontainebleau, he painted largely en plein air, including this fine view of Fir Trees in Les Trembleaux, near Marlotte from 1854.

The great animalière Rosa Bonheur lived on the edge of the forest, where she painted some fine watercolours, including her Deer in the Forest of Fontainebleau (1862). By that time, the next generation was getting ready to take over from the Barbizon School.

Here are this weekend’s Mac riddles to entertain you through family time, shopping and recreation.

1: Two credentials or 762 should be superseded by passkeys.

2: Notably from Autodesk but once by Claris, it’s 3,245.

3: From the Mac II until replaced by USB, 2,779 was quite enough.

To help you cross-check your solutions, or confuse you further, there’s a common factor between them.

I’ll post my solutions first thing on Monday morning.

Please don’t post your solutions as comments here: it spoils it for others.

If there’s one topic that needs explanation currently, it’s how macOS updates XProtect’s data. Let me try.

Up to and including macOS Sonoma

Until this changed in Sequoia, updating XProtect has been straightforward: its data is stored in a bundle named XProtect.bundle, in the path /Library/Apple/System/Library/CoreServices, on the Data volume so it can readily be updated. When you or macOS downloads and installs an XProtect update, it simply replaces that bundle with the new one. This is shown in the diagram below.

The source of those updates is Apple’s Software Update Service, through the Software Update pane in System Preferences or System Settings, the softwareupdate command tool, or an app like SilentKnight. Left to its own devices, macOS normally checks for updates soon after starting up, and once every 24 hours running after that.

Early Sequoia

XProtect in macOS 15 prefers not to use the XProtect.bundle in its old location of /Library/Apple/System/Library/CoreServices, instead looking for XProtect.bundle in its new location, /var/protected/xprotect.

However, when you or your Mac use the old update system, including Software Update, softwareupdate or SilentKnight, that still installs the update in the old location, where it won’t normally be used by XProtect when making its checks. What was supposed to happen in early versions of Sequoia was that at least once a day, macOS checked whether there was a newer update in the old location. If there was, then it should have automatically prepared and moved that to the new location in /var/protected/xprotect for XProtect to use.

If you wanted that to happen immediately, then you could run the following command in Terminal:
sudo xprotect update
then enter your admin user’s password. The xprotect command tool would then complete the installation of that update from its old location into its new one.

There’s also a second way that XProtect in early Sequoia could be updated, and that’s over a connection to iCloud. If that was used, then the update was installed straight into its new location, and didn’t change the XProtect bundle in the old location at all. Although Apple had used that earlier, all XProtect updates since the release of Sequoia came using the old Software Update system, so needed to be completed using the xprotect command in Terminal.

This is shown in the diagram below. The blue boxes show the old Software Update system, and the pink boxes are the new parts that ensure the update is installed in the new location.

Later, that changed and Apple started releasing updates via iCloud. By about macOS 15.3, xprotect update was no longer able to install XProtect in the new location, and that was only possible once that update had been released to iCloud, from where xprotect update could download and install it to the new location.

Late Sequoia and Tahoe

With the release of macOS 26.0 Tahoe, this changed again. Macs running the latest versions of Sequoia and any version of Tahoe (after 26.0 release) continue to update the old location in /Library/Apple/System/Library/CoreServices as before.

Updating the new location in /var/protected/xprotect can occur by two methods. A background service XProtectUpdateService can:

• ‘activate’ an update from the old location by installing a copy to the new location;
• use CloudKit to download an update available in iCloud and install it directly to the new location.

That service is scheduled to run once every 24 hours.

The end result can appear confusing, but is summarised in the diagram below.

There are two routes for XProtect data to be updated in the new location:

• XProtect in the old location is updated by softwareupdate, then XProtectUpdateService runs later and installs a copy of that update to the new location.
• XProtectUpdateService runs and detects an update available from iCloud, so downloads and installs that in the new location. That occurs even when the old location hasn’t been updated yet, but depends on the update being offered in iCloud.

Both of those updates run silently, and the only ways to check that the new location has been updated are to:

• check the version in /var/protected/xprotect,
• run xprotect version,
• use SilentKnight or Skint.

As far as the user is concerned:

• Updating XProtect in the old location is worthwhile, as it should enable XProtectUpdateService to update the new location from that.
• Running xprotect update in Terminal is only worthwhile if the new location hasn’t yet been updated, but that update has been released via iCloud, as confirmed using xprotect check.
• Either of the new update mechanisms should be run automatically within 24 hours of an update being released.

Summary

• In macOS Sonoma and earlier, XProtect updates come via Software Update, and are simple.
• In macOS Sequoia and later, XProtect updates are more complex, but should happen as if by magic within about 24 hours of their release.

The Eurasian wolf has been subject to a general campaign of extermination across much of Europe since the Middle Ages. The last in England was killed by the end of the fifteenth century, in Scotland in 1684, Denmark in 1772, and Norway in 1973. This hasn’t deterred artists from reminding Europeans of their sinister reputation.

Early in Ovid’s Metamorphoses, he tells of Lycaon, who was transformed into a wolf by Jupiter as punishment for cheating him.

Jan Cossiers’ impressive Jupiter and Lycaon from about 1640 shows Jupiter’s eagle vomiting thunderbolts at Lycaon, who is hurrying away as he is being transformed into a wolf, becoming the prototype for the werewolf of the future (see below).

Wolves got a better press in the popular account of the origins of Romulus and Remus, founders of Rome. Numitor’s daughter, a Vestal Virgin, was discovered to be pregnant. Although that would by tradition have led to her death, Amulius’ daughter interceded, and she was merely kept in solitary confinement. She gave birth to twin boys, who were superhuman in their size and beauty. Amulius ordered one of his servants to take the twins away and drown them in the river, but they were put first into a trough that functioned as a boat. As a result they were washed ashore downstream still alive. A she-wolf then fed the babies, and a woodpecker watched over them; both were later considered to be sacred to the god Mars.

One of the frescoes in the Palazzo Magnani, probably painted by Ludovico Carracci and/or Annibale Carracci, shows the She-Wolf Suckling Romulus and Remus (1589-92). The twins are still inside the trough in which they had survived their trip down the river, and on the opposite bank a woodpecker is keeping a close watch.

Peter Paul Rubens shows Romulus and Remus being discovered by Faustulus, in his painting of 1615-16. Not only is the she-wolf taking care of the twins, but a family of woodpeckers are bringing worms and grubs to feed them, and there are empty shells and a little crab on the small beach as additional tasty tidbits.

Despite that, the wolf had a fearsome reputation in Europe, no doubt amplified by those who sought its extinction.

Pieter Brueghel the Younger’s The Good Shepherd from 1616 shows a shepherd being attacked by a wolf, as he tries to save his flock, which are running in panic into the nearby wood.

Christian associations can be more positive, particularly in the legend of Saint Francis of Assisi and the wolf of Agubbio, or Gubbio, a small mediaeval town in the Apennine Mountains in central Italy. The saint did a deal with the wolf, where the animal would stop terrorising the town, in return for its people providing it with food.

Luc-Olivier Merson’s marvellous painting of The Wolf of Agubbio from 1877 is set in the town’s central piazza, where it’s a cold winter’s day, so cold that the waters of its grand fountain are frozen as they cascade over its stonework. As the townspeople go about their business, there’s the large wolf of its title with a prominent halo, standing at the door of the butcher’s shop. Leaning out from that door, the butcher is handing a piece of meat to the wolf, as shown in the detail below.

A wolf may also appear in association with the Christian virtue of charity, as depicted by Pierre Puvis de Chavannes.

His Charity from 1887 is a personification of one of the seven Christian virtues set in timeless classical terms. She is the mother of twins, one of whom she holds by her breast. She is clasping the back of the neck of a dark wolf, lying beside her, adding an unusual touch. This had apparently become a popular motif, and only nine years previously had been painted by William-Adolphe Bouguereau in contrasting Academic style.

A wolf is one of the three fearsome animals to threaten Dante in the opening of his Divine Comedy. Camille Corot’s painting of Dante and Virgil from 1859 shows Dante as he started to walk up a hill, only to find his way blocked first by a leopard, then by a lion, and finally by a wolf.

Wolves have made their way into other legends and fables.

Jean-Baptiste Oudry’s undated The Wolf and the Lamb tells a popular story (Perry 155, La Fontaine I.10) in which a wolf tries to justify killing a lamb on the strength of its criminal record. The lamb proves each crime claimed by the wolf to have been impossible, so the wolf says that the offences must have been committed by someone else in the lamb’s family, therefore it can proceed to kill the lamb anyway.

Gustave Moreau revisited Aesop’s fables late in his career. The Wolf and the Lamb of 1889 is, I believe, a monochrome image of a painting made in full colour, whose wolf looks more threatening than Oudry’s.

Mediaeval folk mythology developed stories of humans turning into wolves, although these were temporary transformations associated with cannibalistic episodes. They became progressively refined and popularised into the Gothic ‘horror’ stories of werewolves feeding on human blood, although those didn’t reach painting until the twentieth century.

Stuart Pearson Wright’s magnificent Woman Surprised by a Werewolf (2008) was inspired by the movie An American Werewolf in London (1981), itself a further transformation of werewolf stories into comedy horror form. The artist intended “to explore that uncharted place where the mystery and sublime of the romantic landscape meets the high camp and melodrama of Hammer horror”, which has come a long way from Ovid’s original story of lycanthropy.

Finally, wolves can sometimes be depicted as hunting quarry.

Peter Paul Rubens’ Wolf and Fox Hunt from about 1616 is one of his brilliant series of hunting scenes, here featuring two large wolves.

The good news is that, since the 1950s, populations of wolves in Europe have been recovering, and with the exception of the British Isles, they’re gradually re-establishing themselves in those countries that had previously hunted them to death.

Virtual Machines running macOS on Apple silicon Macs are more versatile than the host they run on. When you want to create a new VM, or modify an existing one, there are some powerful options available.

One of the most useful is to duplicate an existing VM: as APFS will do that using clone files, and the virtual disk in a VM is stored as a sparse file, that will use much less disk space than making a completely new VM. If you’re likely to need a supply of VMs running the same version of macOS, why not create a base VM using the IPSW for that version, duplicate it, then set up each clone as you require?

For even more flexibility, you can increase the size of the VM as I have already explained. The only remaining problem is how you can migrate the contents of one VM to another. Although my previous attempts to do this had been unsuccessful, Michael was kind enough to provide the solution, and this article explains how to use Migration Assistant in two VMs running concurrently to copy the contents of one VM to another, on the same host Mac. This should also enable you to migrate between a VM and a Mac.

To perform a successful migration, Migration Assistant needs to connect to a mounted Data volume on local storage, or over a network. It can’t use a VM shared folder on the host as the source (server). If your virtualiser supports root level access to USB storage, enabling it to mount an external disk in the VM, then you should be able to migrate from a Time Machine or other backup on that disk. Migration can be performed during initial setup and customisation of macOS, or by running Migration Assistant later. In this walkthrough, I’ll use the former.

You need

To do this, the virtualiser has two fundamental requirements:

• it must be able to run two macOS VMs concurrently,
• you must be able to assign them different MAC addresses.

Apple enforces a limit of two macOS VMs running concurrently on the same Mac, a rule written into the macOS license. Although that might seem stingy, macOS isn’t like Linux and you can’t run Tahoe on a single core with a mere 3-4 GB of memory. However, if you can spare at least 3 P cores and around 12 GB of memory for each, there should be ample to perform a migration. In practice, that means the host Mac should have a total of eight or more P cores, and at least 32 GB of memory.

MAC addresses are supposed to be unique. As the connection between these two VMs is over your local network, your DHCP server must allocate them two different IP addresses, or they won’t be able to migrate. The way to ensure that works is to assign each VM its own and different MAC address.

My own free Viable satisfies both requirements. Here I’ll use that to set up a new VM as the migration client, using an existing VM as the server. For the sake of simplicity, I’ll assume the MAC address of the server is the default, and won’t change that.

Procedure

This uses two macOS VMs running at the same time:

• the destination for the migrated files is a new VM and is the migration client,
• the source of those files is an existing VM and is the migration server.

Start by installing the IPSW to create your new VM. Rather than going straight on to its first run, at this stage open the server VM with the default MAC set, log into it, and locate Migration Assistant in /Applications/Utilities ready to run.

Now change the MAC address in Viable’s window to something different. I used d6:a7:58:8e:79:d4 instead of d6:a7:58:8e:78:d4. Then open the new VM, the migration client, and take it through its configuration, opting to migrate to it from another Mac.

When you reach the screen that sets that up, open Migration Assistant on the server VM, and set it to transfer data To another Mac. Then switch back to the client VM, and you should see that server offered as the source for your migration. Select it and perform the PIN authorisation so they can connect.

On the client, select the items you want to migrate to that VM, and proceed.

After a few minutes, the migration should complete, allowing the client to finish setting up with its new user account. You can then shut down the server and reset the MAC address and other settings in Viable.

Summary

Viable’s narrative documents the sequence:

• Install the IPSW to create the new client VM.
• Start up the server VM with 3 cores and 12 GB memory, and the default MAC of d6:a7:58:8e:78:d4.
• Start up the client VM, with the same cores and memory, and a different MAC of d6:a7:58:8e:79:d4
• When the new (client) VM reaches the Transfer information to this Mac window, open Migration Assistant on the server (old) VM and set it to transfer To another Mac.
• Select the items to migrate on the new (client) Mac and proceed.

Apple’s instructions on migration are here.

During the 1890s Christian Krohg was kept busy as a journalist. He visited the Lofoten Islands in the far north of Norway in the summer of 1896, and the following year visited the Netherlands and France. The year after, 1898, saw more travel, this time to Spain and France. He returned to Oslo in the late summer, where he remained until 1901.

In the late 1890s, Krohg returned to painting maritime motifs. These included yachting, as in The Shoal of 1898, showing a small wood-hulled cruising yacht sailing past a post mounted on a submerged pinnacle. In the depths below the post there are vague forms suggesting the hidden shoal. Unusually for Krohg, there isn’t a single figure to be seen, just the marker, the boat, and a choppy sea.

Judging by the number of Krohg’s paintings featuring small yachts, he appears to have been an enthusiastic sailor, although I haven’t seen any mention of that.

In his Setting Sail (c 1900), Krohg has switched to a clinker-built fishing boat, as two of its crew haul on a line to raise one of its sails. His figures are rougher and more sketchy here, but are clearly the same weather-beaten working men that he had painted previously. His composition crops the boat, figures, and mast closely, possibly influenced by photography; he’s believed to have become an enthusiastic photographer by the end of the nineteenth century.

Reefing the Sails (1900) is a more finished work, probably painted entirely in the studio, of two crew working at a height on a square-rigged sailing ship, another step up in scale. As they balance precariously to secure the sail to the spar, the sea far below them is white with breaking waves. Once again Krohg uses a close-cropped composition that may well have been based on a photograph.

Evening Breeze (c 1900) continues his maritime theme, but seems an odd, one-off painting. A nude woman stands in front of the setting (or rising) sun, holding her long blonde tresses out at arm’s length. She appears unreal: pale, almost a vision rather than solid and substantial form. I wonder if this was Krohg’s articulation of a new artistic vision.

In 1901, Krohg and his family moved to Paris. Although this was ostensibly to continue with his writing, he was soon taking on private pupils in art, and the following year returned to more serious painting when he started teaching at the Académie Colarossi in the city.

The only painting of Krohg’s I have been able to find from this period is another unusual one-off: The Umbrella (1902), which looks from its white picket fences as if it may have been painted in Norway. It’s a view looking down, presumably from the window of a building, on a lone woman. She is walking up a rough earth track, strewn with rocks, in windy weather. The umbrella of the title has been blown out by the wind. This reminds me of some of the optical explorations in Caillebotte’s earlier paintings.

Christian’s wife Oda painted this wonderful Portrait of Christian Krohg in about 1903. Although made during their years in Paris, it shows the artist by the Grand Café on Karl Johans Gate in the centre of Oslo, as a military band marches along the tramlines.

It wasn’t until 1909 that the Krohgs moved back to Norway, where Christian was appointed the first professor and director of the State Academy of Art (Statens kunstakademi), the latter post being held until the year of his death. The following year he finally ceased work as a journalist.

Krohg then tackled a new theme over a series of paintings. The first may be this Toilet (1912), in which a woman is seen in front of a full-length mirror. Although her clothing appears light and flimsy, as if underwear, she looks to be wearing a hat, at least in her reflection, where its brim stands proud of her head. Krohg’s facture is rough, and the woman’s features are partially obscured in his marks.

The Model (c 1913) is a sketchy portrait of a nude woman, who is just turning the knob of a door to open it, perhaps at the end of a modelling session. Krohg painted others in this series.

Girl Tying her Garter (1914) might bring the series to a logical and temporal conclusion, as a model completes dressing, ready to walk out of the studio. The strange object hanging at the top left appears to be an artist’s palette, or a hat.

In his latter years, Krohg returned to his major theme of the fallen woman and prostitution. In 1917, he produced a new compositional sketch for his famous Albertine in the Police Doctor’s Waiting Room that he felt addressed his earlier painting’s theatricality.

He also painted an almost Dickensian narrative in his Seamstress’s Christmas Eve (1921). A young woman is in her garret bed-sit, where she has been toiling long hours at her sewing machine. An affluent couple, relatives or employers perhaps, have just arrived to give the young woman a Christmas tree, a large wicker basket of presents, and more. The oil lamp on the sewing table casts only a weak light, making the scene appear almost monochrome, in keeping with the young woman toiling in poverty and squalor.

Five to Twelve (c 1924) was one of Krohg’s last paintings, and appears to be a self-portrait. He’s shown with a long white beard, and almost bald, asleep in a chair underneath a pendulum clock. The face of the clock is completely blank, but the title tells us the time: it is five minutes to midnight, very late in his life.

In 1925, Krohg retired as the director of the State Academy of Art, and he died in Oslo a few months later, on 16 October. Although his paintings have been exhibited at many solo events in the Nordic countries, and alongside the works of others in many overseas exhibitions, he has still not had a one-man show outside Scandinavia, as far as I am aware.

References

Skagens Museum, Denmark
Øystein Sjåstad (2017) Christian Krohg’s Naturalism, U Washington Press. ISBN 978 0 295 74206 9.

If your Mac starts to boot but doesn’t get as far as displaying the login window, one of four things should happen:

• if it has been upgraded to macOS 26 Tahoe or later, it might restart into Recovery Assistant;
• it might restart, and repeat the same sequence again;
• it might simply freeze and go no further;
• it might shut itself down again.

The second of those is the most urgent, as it’s in a boot loop, and you need to force it to shut down by pressing and holding the Power button. Although macOS should limit the number of boot loops, don’t leave it to continue looping. If your Mac appears to have frozen, wait for up to an hour before forcing it to shut down, as it could be in the middle of checking and repairing disks, which you shouldn’t interrupt in case it proves successful.

Recovery Assistant

This is a new feature in Tahoe, and uses latest data from Apple to try to recover your Mac automatically. For it to do that it requires an internet connection, preferably over Wi-Fi.

Distinctive to its opening window is its first aid symbol ⊕. Click on the Continue button to move on, and follow its instructions. At the end of that, you should see one of three outcomes:

• no problems were found, and you can restart your Mac back into normal mode;
• problems were found and repaired successfully, so you can restart your Mac back into normal mode;
• problems were found but aren’t fully repaired.

When your Mac restarts, it may show a notification that you need to recover iCloud data. If so, open System Settings and you should see a new item in its sidebar to Recover iCloud Data.

If that doesn’t fix your Mac, you’ll almost certainly need to start up in Recovery and try to fix it there.

Boot loops and freezes

Boot loops happen when a kernel panic occurs during the boot process, before the login window is displayed. When the Mac tries to restart as a result, it hits the same kernel panic, and starts the cycle again. Boot freezes are the opposite: instead of repeatedly cycling through reboot-panic, the boot process comes to a complete halt, normally showing a stuck progress bar on the display. Thankfully neither is in the least common, and should have become even rarer with the introduction of the Signed System Volume (SSV) in Big Sur and later, and the deprecation of third-party kernel extensions.

What you do next on an Apple silicon Mac depends on whether it’s trying to load third-party kernel extensions. As Intel Macs don’t enjoy the same secure boot process, dealing with them is more difficult.

When an Apple silicon Mac is running at Full Security, the only kernel extensions that it loads are those provided in macOS, whose integrity is checked during the boot process. Any third-party kernel extensions included in the Auxiliary Kernel Collection in /Library/KernelCollections remain untouched. Likely causes of kernel panics during booting in Full Security mode include failure of validation of the on-disk root hash of the SSV, and hardware faults or errors, either internal or external.

An Apple silicon Mac running at Reduced Security can load third-party kernel extensions from the Auxiliary Kernel Collection in /Library/KernelCollections when that is explicitly enabled in Startup Security Utility. In the absence of any more probable reason for a kernel panic occurring during booting, it should be assumed that the cause is a third-party kernel extension, and that should be disabled in Recovery mode. This can only be done in paired Recovery, following a single long press of the Power button, not in fallback Recovery.

Restarting in Full Security should then complete normally, and allow the third-party kernel extension to be updated or uninstalled as needed.

Diagnostics and Recovery

In most cases, boot loops and freezes are best assessed by disconnecting all suspect peripherals, running Diagnostics and Disk Utility’s First Aid in paired Recovery mode. If that isn’t available, then Fallback Recovery can be used instead. Unfortunately, the most valuable diagnostic tool for kernel panics, the panic log, usually isn’t accessible when a panic has occurred during boot, although it may be shown when you get the Mac to start up normally again.

Before starting up in Diagnostics, disconnect all peripherals, except those that are essential such as keyboard, mouse/trackpad and any primary external display. Ensure a good Wi-Fi network connection can be made. If the problem occurred when trying to boot from an external disk, or if that Mac had previously been booting from one, it may be better to leave that connected; historically, some older combinations of firmware and macOS panic when an external boot disk has been disconnected but is still expected for the next boot.

On Apple silicon Macs, Diagnostics is unique in relying on a hidden key combination: at the initial Recovery screen, hold Command-D until the Diagnostics Loader starts. This may require download of the disk image from Apple’s servers before testing can proceed. Once loaded, there’s a hidden option for extended diagnostics that can be triggered by holding the Command-E key combination.

Disk Utility is accessed as usual from the main Recovery window.

Advanced tools

Previous tools for the management of kernel extensions included kextload, kextunload and others. In Big Sur and later, these have been replaced by a single command tool kmutil, which is inevitably complex to use. Full details are given in its man page, which is extensive and an excellent source of additional information.

There are at least four kmutil commands that could prove useful:

• kmutil trigger-panic-medic, only available in recoveryOS, clears the AKC at /Library/KernelCollections and forces it to be rebuilt, requiring each kernel extension to be re-approved before it can be loaded. This is intended to be used to recover a system following a kernel panic generated by one of the kernel extensions in the AKC.
• kmutil inspect lists all currently installed kernel extensions according to their collection.
• kmutil clear-staging clears the contents of the staging directory /Library/StagedExtensions.
• kmutil unload -p /path/kextname.kext unloads the kernel extension specified by /path/kextname.kext. This terminates and unloads it, but doesn’t remove the original kernel extension or any staged copy. Unless you also remove the kernel extension and remove it from its collection, it’s likely to load again at the next boot.

In theory, removing the original kernel extension by removing the app which contains it, or deleting it from /Library/Extensions, should trigger kernelmanagerd to remove it from the Auxiliary Kernel Collection and the staging directory /Library/StagedExtensions. However, that won’t take effect until after the next reboot. If the kernel extension isn’t then removed, it may be worth using kmutil clear-staging, and if necessary kmutil trigger-panic-medic in Recovery mode. Remember that kernel extensions may be left unused in staging, and are protected there by SIP, making manual removal tedious at best, and possibly pointless.

While system extensions shouldn’t cause kernel panics or freezes during the boot process, the command tool available to manage them is systemextensionsctl. You can use
systemextensionsctl list
to list all known system extensions and their status.

To remove an orphaned system extension, with SIP already disabled, first list those known using
systemextensionsctl list
to provide the teamID and bundleID. Then use those in the command
systemextensionsctl uninstall teamID bundleID
and don’t forget to re-enable SIP immediately afterwards.

Reinstalling macOS

Historically, reinstalling macOS has often been advocated as a means of addressing boot loops and freezes. In Macs that perform full checking of the integrity of the SSV, Intel Macs with a T2 chip and Apple silicon models, that’s generally unwarranted.

Another option worth considering might be starting up in Safe mode, as that blocks the loading of most third-party components that could cause conflicts before the login window is loaded.

Reviving firmware

One well-known if rare cause of boot looping is a problem with firmware. For Intel Macs with T2 chips and Apple silicon Macs, the preferred solution to that is to boot the Mac in DFU mode, connect another Mac running a recent version of macOS, and perform a Revive from there. This is non-destructive of the SSV and Data volume, unlike a full Restore. Apple provides detailed instructions for you to do this yourself, provided you have the necessary second Mac and cable.

The cable used mustn’t be Thunderbolt, but plain USB-C. That’s because DFU mode doesn’t support Thunderbolt or its cable. Connect that to the designated DFU port on the Mac you’re going to Revive. That can be found in Apple’s note, or in Mactracker.

Summary

• If it starts up in Recovery Assistant (Tahoe and later only), ensure an internet connection and continue with that.
• If it’s stuck in a boot loop, force shutdown with the Power button, and disconnect all non-essential peripherals.
• If it appears frozen, leave it up to an hour in case it’s repairing its disk, before forcing shutdown.
• Try starting up in Recovery.
• For Apple silicon Macs in Reduced Security, disable loading of third-party extensions and set it to Full Security in Startup Security Utility.
• Consider running hardware Diagnostics.
• On Intel Macs consider kmutil trigger-panic-medic in Recovery.
• Try Revive in DFU mode to refresh firmware.
• Good luck!

Apple has released its weekly update to XProtect, bringing it to version 5318. As usual, it doesn’t release information about what security issues this update might add or change.

This version makes several changes to the Yara definition for MACOS.COMPLIANTPIRATE.DEFU, but doesn’t add any new detection rules.

You can check whether this update has been installed by opening System Information via About This Mac, and selecting the Installations item under Software.

A full listing of security data file versions is given by SilentKnight and SystHist for El Capitan to Tahoe available from their product page. If your Mac hasn’t yet installed this update, you can force it using SilentKnight or at the command line.

If you want to install this as a named update in SilentKnight, its label is XProtectPlistConfigData_10_15-5318

Sequoia and Tahoe systems only

This update has now been released for Sequoia and Tahoe via iCloud. If you want to check it manually, use the Terminal command
sudo xprotect check
then enter your admin password. If that returns version 5318 but your Mac still reports an older version is installed, you should be able to force the update using
sudo xprotect update
However, if the regular update has been installed in the old location, XProtect is likely to update its new location from that. There’s nothing you can do to force that, but it may well explain why your Mac seems to have updated itself.

Updated 0450GMT 9 October 2025.

Before the Dutch Golden Age, painting scenes at night had been restricted to religious and other narrative works, and very few if any landscapes had been depicted during the hours of darkness. After all, what’s the point of a view if it’s all dark and you can’t admire it?

The Dutch Republic changed that, in part because it was in Northern Europe, where for several months each year it’s mostly dark, and these nocturnes had novelty value. Among those of the middle class who could afford to, it was fashionable to cover the walls inside your house with paintings, and nocturnes, known then as maneschijntjes (moonshines), certainly brought variety to those collections.

Aelbert Cuyp’s view of the Sea by Moonlight from about 1648 is one of the earlier maritime nocturnes, something of a sub-sub-genre that must have been sought after. Unlike many others, this appears to be faithful to the original light.

During the 1640s, Aert van der Neer, a landscape painter in Amsterdam, started experimenting with his first nocturnes, and came to specialise in them.

His River View by Moonlight from about 1650-55 shows a bustling village on a river, with several boats under way and two windmills in the distance. The moon appears to be depicted faithfully in terms of size, without the common tendency to exaggerate that as a result of the Moon Illusion. Surviving studies for some of these nocturnes demonstrate that van der Neer initially sketched a landscape in daylight, and based the detail in his finished studio painting on that.

In about 1655, he painted this finely detailed River Landscape with Moonlight, with a larger moon lighting clouds dramatically.

Some of his best nocturnes are lit by a combination of the moon and the warmer light from a fire. This undated Estuary Landscape by Moonlight uses light from both sources to great effect. Landscape details are shown largely in silhouette, and lack internal detail except in the group gathered around the fire in the foreground. Van der Neer is unusually faithful to reality in this monochrome, the result of the severely impaired colour vision we all suffer in conditions of low light, when there’s insufficient to enable colour vision using the cone cells in the human retina.

At some stage, van der Neer started painting more destructive fires, including this undated Fire in Amsterdam by Night, leading to another sub-sub-genre that was taken up by others.

In mid 1652, Jan Abrahamsz Beerstraaten seems to have witnessed the destruction by fire of part of the centre of Amsterdam, which formed the basis of his studio painting of The Old Town Hall of Amsterdam on Fire, 7 July 1652 (1652-55). Local inhabitants are walking in orderly queues to boats, in which they escape from the scene. This may have been the same fire painted by van der Neer, above.

Egbert van der Poel specialised in these brandjes,, and probably painted more than any other artist in history. He moved to Delft in 1650, and four years later was a victim of the massive explosion in a gunpowder store there on 12 October 1654. That killed one of his children, and he moved again to Rotterdam.

It has been thought that most of van der Poel’s Fire of a Church with Staffage and Cattle from 1658 is a carefully-composed composite of his experiences. A small church at the edge of a village is well ablaze, and the inhabitants are abandoning it, taking all the possessions they can, including their horses and livestock, and leaving the fire to burn itself out.

Van der Poel’s undated A Fire at Night shows a similar scene and composition, set this time on the bank of a canal.

One established exception to this is van der Poel’s Fire in De Rijp of 1654, completed in 1662. This shows a fire that worked its way through more than eight hundred buildings in the town of De Rijp during the night of 6 January 1654. This left only the northern section of the town standing and inhabitable, and resulted in more casualties than did the more famous explosion in Delft at the end of that year.

Doubt is cast on this received account of van der Poel’s work by sketches such as this, of The Fire in the Nieuwe Kerk, Amsterdam, in 1645, made in front of the motif using washes with touches of pen and brown ink. Perhaps he was the first ‘ambulance chaser’ who travelled out to sketch fires, from which he later painted his famous brandjes in the studio.

For the non-specialist like Jacob van Ruisdael, winter was an ideal opportunity to explore the effect of negative images, where objects that would normally be seen as dark on a light background were reversed to white on dark.

Van Ruisdael painted at least two such landscapes featuring trees. Both are now known by the same name, and are believed to be from the same decade. This Winter Landscape (c 1660-70), in the Mauritshuis, picks out frosted leaves in the half-light of dusk or dawn, by a hamlet at the water’s edge. In the far distance, to the left of the buildings, there is a church with a spire.

The other version of Winter Landscape (c 1660-70) is in Birmingham, Alabama. With similar sky, cloud, lighting, and composition, the water here appears to have frozen over. The frost on the trees is just as delicately handled.

If you ever encounter an error when checking an APFS volume using First Aid in Disk Utility or fsck_apfs, you won’t be informed of the path and name of the item responsible, but given its inode number, in an entry like
warning: inode (id 402194151): Resource Fork xattr is missing for compressed file

The inode number given can only be resolved to a path and file/folder name if you also have a second number giving the volume for that item. As that will be for the volume being checked at the time, you should be able to identify that immediately. The only time that you might struggle to do that is with items in a snapshot; those should, I think, be the same as the volume they are taken from. However, as snapshots are read-only, there’s probably little point in pursuing errors in them.

To resolve these in my free utility Mints, open its inode Resolver using the Window / Data… / Inode menu command. Drag and drop another file from the same volume onto that window.

The Resolver will then display that file’s volfs path, such as
/.vol/16777242/1241014

All you need do now is paste the inode number given in the warning or error message in Disk Utility or fsck_apfs, into the Inode Number box at the top of the Resolver window, and click the Resolve button. Mints then looks up information for that inode number on the same volume, using GetFileInfo, and displays it below.

One drag and drop, a paste, and a click to discover what APFS is complaining about.

Command line

You’ll sometimes see Terminal’s find command with the option -inum recommended as a way to convert from an inode number to a regular path. Although you can do that, it’s easier to use the command GetFileInfo instead. For that you’ll need the full volfs path, including the volume number.

To find the volume number, use my free utility Precize, and open another file on the same volume. The second line in its window gives the full volfs path for that file. Copy the start of that, leaving the second number, the inode, such as
/.vol/16777238/

Alternatively, you can use the stat command as given below.

In Terminal, type
GetFileInfo
with a space at the end, and paste the text you copied from Precize. Then copy and paste the inode number given in the First Aid warning, to assemble the whole command, such as
GetFileInfo /.vol/16777238/402194151

Press Return, and after a few seconds, you should see something like
file: "/Users/hoakley/Library/Mobile Documents/com~apple~CloudDocs/backup1/0MintsSpotlightTest4syzFiles/SpotTestA.rtf"
type: "\0\0\0\0"
creator: "\0\0\0\0"
attributes: avbstclinmedz
created: 05/17/2023 08:45:00
modified: 05/17/2023 08:45:00
giving the full path and filename that you want.

GetFileInfo is one of the oldest commands in macOS, and has been deprecated as long as anyone can remember. I suspect that Apple is still trying to work out what can substitute for it.

Get a volfs path for a file

Use Precize to run this the other way around: open the file and read the path in that second line. To copy the whole of it, press Command-2.

The simplest ways of obtaining inode numbers and so building volfs paths in Terminal are using the -i option to the ls command, and for individual items using stat:
ls -i lists each item in the current directory, giving its inode number first, e.g.
22084095 00swift
13679656 Microsoft User Data
22075835 Wolfram Mathematica
and so on;
stat myfile.text returns
16777220 36849933 -rw-r--r-- 1 hoakley staff […] myfile.text
where the first number is the volume number, and the second is the inode number of that item, or /.vol/16777220/36849933.